Like 0
Fork 0

Last active 1 month ago

sysop revised this gist 1 month ago. Go to revision

1 file changed, 284 insertions

clickfix-remedy-suggestions.md(file created)

@@ -0,0 +1,284 @@
1 + **ClickFix** attacks rely on social engineering rather than software exploits. The user is tricked into copying or executing commands (often PowerShell) to “fix” a fake issue such as a CAPTCHA, browser error, or update. Because the user voluntarily runs the command, many traditional protections are bypassed.
2 +
3 + Effective defense requires restricting what a standard user can execute and detecting suspicious scripting activity.
4 +
5 + ---
6 +
7 + ## 1. Block or Constrain PowerShell Execution
8 +
9 + Most ClickFix payloads are delivered via PowerShell.
10 +
11 + **Controls:**
12 +
13 + * **PowerShell Constrained Language Mode**
14 + * **Disable PowerShell v2**
15 + * **Script Block Logging**
16 + * **Module Logging**
17 + * **Transcription Logging**
18 +
19 + Example hardening via GPO:
20 +
21 + ```
22 + Computer Configuration
23 + Administrative Templates
24 + Windows Components
25 + Windows PowerShell
26 + Turn on Script Block Logging
27 + Turn on Module Logging
28 + Turn on PowerShell Transcription
29 + ```
30 +
31 + Recommended execution policy:
32 +
33 + ```
34 + Set-ExecutionPolicy AllSigned
35 + ```
36 +
37 + For higher security environments:
38 +
39 + ```
40 + Disable PowerShell for non-admin users
41 + ```
42 +
43 + or use **AppLocker / WDAC** to restrict PowerShell entirely.
44 +
45 + ---
46 +
47 + ## 2. Application Allow-Listing (Very Effective)
48 +
49 + ClickFix often launches:
50 +
51 + * `powershell.exe`
52 + * `cmd.exe`
53 + * `mshta.exe`
54 + * `wscript.exe`
55 + * `cscript.exe`
56 + * `rundll32.exe`
57 + * `regsvr32.exe`
58 +
59 + Use allow-listing to prevent standard users from launching these unless required.
60 +
61 + ### Option A — AppLocker
62 +
63 + Create rules such as:
64 +
65 + Allow:
66 +
67 + ```
68 + %WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe
69 + ```
70 +
71 + Only for **IT admins group**, not standard users.
72 +
73 + Block:
74 +
75 + ```
76 + cmd.exe
77 + powershell.exe
78 + mshta.exe
79 + wscript.exe
80 + cscript.exe
81 + ```
82 +
83 + for regular users.
84 +
85 + ### Option B — Windows Defender Application Control (WDAC)
86 +
87 + Stronger than AppLocker.
88 +
89 + Policies can enforce:
90 +
91 + * only signed Microsoft binaries
92 + * only approved scripts
93 + * block script interpreters entirely
94 +
95 + ---
96 +
97 + ## 3. Attack Surface Reduction (ASR) Rules
98 +
99 + These are extremely useful for this attack class.
100 +
101 + Enable these rules in Microsoft Defender:
102 +
103 + Key rules:
104 +
105 + **Block Office applications from creating child processes**
106 +
107 + ```
108 + GUID: D4F940AB-401B-4EFC-AADC-AD5F3C50688A
109 + ```
110 +
111 + **Block executable content from email and webmail**
112 +
113 + ```
114 + GUID: BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550
115 + ```
116 +
117 + **Block credential stealing from LSASS**
118 +
119 + ```
120 + GUID: 9E6C4E1F-7D60-472F-BA1A-A39EF669E4B2
121 + ```
122 +
123 + **Block process creation from PSExec/WMI**
124 +
125 + ```
126 + GUID: D1E49AAC-8F56-4280-B9BA-993A6D77406C
127 + ```
128 +
129 + ASR dramatically reduces post-click exploitation.
130 +
131 + ---
132 +
133 + ## 4. Block Dangerous LOLBins
134 +
135 + ClickFix attacks frequently use “Living Off the Land Binaries”.
136 +
137 + Block for standard users:
138 +
139 + ```
140 + mshta.exe
141 + regsvr32.exe
142 + rundll32.exe
143 + powershell.exe
144 + cmd.exe
145 + wscript.exe
146 + cscript.exe
147 + bitsadmin.exe
148 + certutil.exe
149 + ```
150 +
151 + This can be done with:
152 +
153 + * AppLocker
154 + * WDAC
155 + * EDR policies
156 +
157 + ---
158 +
159 + ## 5. Browser Protections
160 +
161 + Most ClickFix attacks begin in the browser.
162 +
163 + Enforce policies for:
164 +
165 + * block **clipboard access prompts**
166 + * disable **automatic downloads**
167 + * disable **“paste into console” warnings bypass**
168 +
169 + Chrome/Edge enterprise policies:
170 +
171 + ```
172 + ClipboardAllowedFormats = restricted
173 + DefaultDownloadRestrictions = 3
174 + ```
175 +
176 + Additionally:
177 +
178 + Enable **SmartScreen**.
179 +
180 + ---
181 +
182 + ## 6. DNS / Web Filtering
183 +
184 + Block known delivery domains.
185 +
186 + Good protection layers:
187 +
188 + * DNS filtering
189 + * Secure web gateway
190 + * block newly registered domains
191 +
192 + Recommended:
193 +
194 + * block domains <30 days old
195 + * block dynamic DNS providers
196 +
197 + ---
198 +
199 + ## 7. Endpoint Detection
200 +
201 + Look for suspicious command patterns like:
202 +
203 + ```
204 + powershell -enc
205 + powershell -nop
206 + powershell -w hidden
207 + iex (new-object net.webclient)
208 + curl | powershell
209 + ```
210 +
211 + Monitoring tools should alert on:
212 +
213 + * encoded PowerShell
214 + * clipboard-to-terminal patterns
215 + * child processes spawned by browsers
216 +
217 + ---
218 +
219 + ## 8. Disable PowerShell from Browser Context
220 +
221 + Many attacks launch PowerShell via browser.
222 +
223 + Block this chain:
224 +
225 + ```
226 + browser -> powershell
227 + browser -> cmd
228 + browser -> mshta
229 + ```
230 +
231 + Defender / EDR rules can block **browser-spawned script interpreters**.
232 +
233 + ---
234 +
235 + ## 9. User Copy-Paste Protection
236 +
237 + Some EDR tools now block suspicious clipboard commands.
238 +
239 + Policies:
240 +
241 + * prevent pasting commands containing
242 +
243 + * `powershell`
244 + * `iex`
245 + * `downloadstring`
246 +
247 + into terminals.
248 +
249 + ---
250 +
251 + ## 10. Security Awareness (Still Required)
252 +
253 + Even with strong controls, user behavior matters.
254 +
255 + Train users:
256 +
257 + Never paste commands from websites into:
258 +
259 + * PowerShell
260 + * Terminal
261 + * Command Prompt
262 +
263 + Legitimate IT support **never instructs users to paste commands**.
264 +
265 + ---
266 +
267 + # Practical Enterprise Baseline (Recommended)
268 +
269 + For an organization like the infrastructure you are designing:
270 +
271 + 1. **WDAC allow-listing**
272 + 2. **ASR rules enabled**
273 + 3. **PowerShell logging + constrained mode**
274 + 4. **block LOLBins for standard users**
275 + 5. **DNS filtering**
276 + 6. **EDR detection for encoded PowerShell**
277 +
278 + This combination stops the vast majority of ClickFix attacks.
279 +
280 + ---
281 +
282 + If useful, a next step can be provided:
283 +
284 + **A hardened Windows security baseline specifically designed to block ClickFix-style attacks (AppLocker + ASR + PowerShell GPO examples).**
Newer Older

Powered by Opengist ⋅ Load: 22ms⋅

English