Detect Malicious Ad Network Placements Delivering Fake-CAPTCHA "ClickFix" Execution Lures in Elastic Security
Adversaries purchase placements on legitimate ad exchanges (Google Ads, Bing Ads, and programmatic networks such as those relayed through doubleclick.net, googlesyndication.com, or taboola.com) that impersonate popular software downloads or display a fake "you are not a robot" verification page. Clicking the ad redirects the victim through the ad exchange to a cloaked landing page instructing them to press Win+R, paste a clipboard-injected string, and press Enter — the "ClickFix" pattern. Because the payload is delivered via clipboard paste into the Windows Run dialog rather than a browser download, it bypasses browser download telemetry, SmartScreen, and mark-of-the-web controls entirely: the resulting process tree shows explorer.exe directly spawning PowerShell, mshta, or cmd with an obfuscated command line, with no antecedent file download. Because the ad-buying infrastructure sits entirely outside the victim environment, detection pivots to victim-side signals: (1) explorer.exe spawning a script interpreter or LOLBin with an encoded/obfuscated command line — the fingerprint of a Run-dialog-driven paste-and-execute lure rather than a normal user-initiated script, and (2) a recent network referral to a known ad-exchange domain on the same host shortly before that spawn, establishing that the lure originated from a malvertised placement rather than an organic script execution.
MITRE ATT&CK
- Tactic
- Resource Development
Elastic Detection Query
sequence by host.id with maxspan=5m
[
network where destination.domain : ("*doubleclick.net", "*googlesyndication.com", "*googleadservices.com", "*adnxs.com", "*adsrvr.org", "*taboola.com", "*outbrain.com", "*bat.bing.com", "*criteo.com", "*pubmatic.com")
]
[
process where process.parent.name : "explorer.exe" and
process.name : ("powershell.exe", "pwsh.exe", "mshta.exe", "cmd.exe", "wscript.exe", "cscript.exe") and
process.command_line : ("*-enc*", "*-encodedcommand*", "*iex*", "*invoke-expression*", "*downloadstring*", "*mshta*http*", "*javascript:*", "*-windowstyle*hidden*", "*-w*hidden*")
]Elastic EQL sequence detection correlating a network connection to a known ad-exchange domain with a subsequent explorer.exe-parented script interpreter spawn carrying an obfuscated command line, within a 5-minute window on the same host — the ad-click-then-Run-dialog-paste pattern that fingerprints a ClickFix-style malvertising lure.
Data Sources
Required Tables
False Positives & Tuning
- Help desk or remote-support sessions where a technician pastes a legitimate script into the Run dialog shortly after unrelated ad-exchange network traffic on the same host
- Freeware or ad-supported software that loads ad-exchange trackers coincidentally near a scheduled, benign script execution
- Security awareness training platforms simulating ClickFix-style lures during phishing exercises
Other platforms for THREAT-Infra-ClickFixMalvertisingLureDelivery
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1 Explorer-Spawned PowerShell With Encoded Command
Expected signal: Sysmon Event ID 1: Process Creation with Image=powershell.exe, ParentImage=explorer.exe (when run manually via Win+R), CommandLine containing '-EncodedCommand'.
- Test 2 Simulated Ad-Exchange Referral Preceding Interpreter Spawn
Expected signal: DeviceNetworkEvents/DNS telemetry showing resolution of googlesyndication.com, followed within seconds by a Sysmon Event ID 1 process creation for mshta.exe with a 'javascript:' command line.
- Test 3 RunMRU Registry Artifact Write via Run Dialog
Expected signal: Sysmon Event ID 13 (Registry Value Set) for TargetObject containing 'RunMRU', with the synthetic command string in RegistryValueData/Details.
Response Playbook
Triage
- Pull the full process tree for the flagged host: confirm explorer.exe is the direct parent of the interpreter process, with no intervening browser process — this rules out ordinary browser-driven drive-by execution and confirms the Run-dialog delivery vector.
- Decode/deobfuscate the child process command line (base64 -EncodedCommand, mshta http reference, or IEX/DownloadString chain) to recover the actual payload URL or script content and determine what was staged.
- Check the HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU registry key on the affected host for the pasted command string, which frequently persists as forensic evidence of the Run-dialog interaction.
- Review browser history and proxy/DNS logs for the affected user in the 5–10 minutes prior to the process spawn for navigation through an ad-exchange redirect chain to a short-lived landing domain (fake CAPTCHA, fake browser-update, or fake software-download page).
- Determine what the payload actually did post-execution: check for outbound connections to C2 infrastructure, credential-store or browser-data access consistent with an infostealer (Lumma, RedLine, Vidar), or additional payload staging typical of a loader.
- Check clipboard history (if enabled via Windows clipboard history or EDR clipboard telemetry) for the pasted string, which can corroborate that the user copied the command from the lure page rather than typing it manually.
Containment
- Isolate the affected endpoint from the network immediately if the decoded payload indicates an active infostealer, loader, or C2 beacon rather than a failed/incomplete lure interaction.
- Force a credential reset and revoke active sessions for any accounts with saved credentials in browsers on the affected host, since ClickFix payloads overwhelmingly deliver commodity infostealers that harvest browser-stored credentials, cookies, and session tokens.
- Block the ad-exchange redirect target and the ultimate landing/payload domain at DNS resolver and proxy; report the malicious ad creative to the ad-exchange platform's abuse/fraud team (Google Ads, Microsoft Advertising) for takedown.
- Hunt across the fleet for the same command-line pattern or payload hash to scope whether this was an isolated click or part of a wider malvertising wave hitting multiple employees who searched for or clicked ads related to the same lure theme.
- If session tokens were harvested, proactively revoke refresh tokens/cookies for SaaS platforms (email, SSO, cloud consoles) the user was authenticated to, since infostealer logs are frequently sold or used for immediate account takeover.
- Brief the security awareness team to circulate guidance discouraging users from ever pasting commands into the Run dialog or a terminal at a website's instruction — this is the core behavioral control against ClickFix regardless of the specific lure theme.
Evidence Collection
- Full Sysmon/EDR process tree for the affected host, including the explorer.exe → interpreter spawn event and any subsequent child processes.
- HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU registry key contents and last-write time.
- Browser history, proxy logs, and DNS logs for the affected user covering the 30 minutes preceding the process spawn.
- PowerShell ScriptBlock logging (Event ID 4104) or AMSI telemetry capturing the deobfuscated script content, if available.
- Network connection logs (DeviceNetworkEvents or equivalent) for the payload process, establishing C2 or download infrastructure contacted post-execution.
- Any EDR clipboard-monitoring telemetry or Windows Clipboard History artifacts corroborating the paste action.
Escalation Criteria
- !The decoded payload is confirmed to be or closely resembles a known infostealer (Lumma, Vidar, RedLine) or RAT (NetSupport) rather than a benign/failed lure interaction.
- !The affected account holds privileged access, saved credentials for sensitive systems, or active sessions to financial/administrative platforms.
- !Multiple users across the organization triggered structurally similar detections within a short window, indicating an active, broad malvertising campaign rather than an isolated click.
- !Post-execution telemetry shows credential/session-token exfiltration, lateral movement, or C2 beaconing following the initial payload execution.
- !The RunMRU or clipboard artifact cannot be correlated to any legitimate support interaction and the user confirms they followed instructions from a website they reached via a search/ad click.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Sysmon Event ID 1 (Process Creation) showing explorer.exe as the parent of the interpreter process. - >
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU registry key, which records the pasted command string entered via the Run dialog. - >
Windows Clipboard History (if enabled) or EDR clipboard-access telemetry corroborating the copy-paste action. - >
Proxy/DNS logs showing the ad-exchange redirect chain and the ultimate cloaked landing domain visited immediately before the process spawn. - >
PowerShell Script Block Logging (Event ID 4104) or AMSI buffer capture containing the deobfuscated payload script. - >
DeviceNetworkEvents/proxy logs for any post-execution C2 or credential-exfiltration connections made by the spawned interpreter or its children.
Tuning Guidance
This detection's core signal — explorer.exe directly spawning a script interpreter — is uncommon in most enterprise environments outside of IT/help desk workflows, so false-positive volume is typically low, but IT support teams frequently trigger Pillar 1 legitimately. Recommendations: (1) Build an allowlist of known IT/help desk accounts or endpoints where Win+R script execution is an expected part of the support workflow, and route their alerts to a lower-priority queue rather than suppressing them entirely; (2) The ad-exchange domain list in AdExchangeDomains/Pillar 2 should be tuned to match the specific ad networks observed in your proxy logs — some organizations block ad-exchange domains outright via web filtering, which would eliminate Pillar 2 coverage entirely but is a strong complementary control; (3) Prioritize alerting on the Pillar 2 correlated hits, since the ad-referral-then-explorer-spawn sequence has very low legitimate-use overlap; (4) Because this technique's entire value proposition to the adversary is bypassing browser-download telemetry, do not rely on browser-download or SmartScreen-based detections as a substitute — this process-lineage detection is the primary control surface; (5) Periodically refresh the SuspiciousCommandPatterns list as actors rotate obfuscation techniques (e.g., alternate encodings, renamed interpreter binaries, or LOLBins beyond the current list).
Hunting Queries
Broad 7-day hunt for explorer.exe-spawned interpreters scored by obfuscation-indicator density, independent of the 24-hour ad-referral correlation used in the primary detection — useful for retroactive scoping once a ClickFix payload family has been identified, or for environments where proxy logs are not yet ingested to support Pillar 2.
// Hunt: explorer.exe-spawned interpreters over a 7-day window, independent of the ad-referral correlation, ranked by command-line obfuscation density
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName =~ "explorer.exe"
| where FileName in~ ("powershell.exe", "pwsh.exe", "mshta.exe", "cmd.exe", "wscript.exe", "cscript.exe", "rundll32.exe")
| extend ObfuscationHits = countof(ProcessCommandLine, "-enc", "normal") + countof(ProcessCommandLine, "iex", "normal") + countof(ProcessCommandLine, "http", "normal") + countof(ProcessCommandLine, "hidden", "normal")
| summarize Occurrences=count(), SampleCommandLines=make_set(ProcessCommandLine, 5) by DeviceName, AccountName, FileName, ObfuscationHits
| order by ObfuscationHits desc, Occurrences descindex=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 ParentImage="*\\explorer.exe"
| where match(Image, "(?i)(powershell\.exe|pwsh\.exe|mshta\.exe|cmd\.exe|wscript\.exe|cscript\.exe|rundll32\.exe)$")
| eval ObfuscationHits=if(match(CommandLine,"(?i)-enc"),1,0)+if(match(CommandLine,"(?i)iex"),1,0)+if(match(CommandLine,"(?i)http"),1,0)+if(match(CommandLine,"(?i)hidden"),1,0)
| stats count as Occurrences, values(CommandLine) as SampleCommandLines by host, User, Image, ObfuscationHits
| sort - ObfuscationHits, - OccurrencesHunt correlating RunMRU registry writes (Sysmon Event ID 13, indicating a command was entered via the Run dialog) with a preceding network referral to a known ad-exchange domain within a 10-minute window — captures the ClickFix pattern even in cases where the resulting process spawn did not match the exact command-line patterns used by the primary detection's Pillar 1.
// Hunt: RunMRU registry writes correlated to a network connection to a known ad-exchange domain within the prior 10 minutes
let AdExchangeDomains = dynamic(["doubleclick.net", "googlesyndication.com", "googleadservices.com", "adnxs.com", "taboola.com", "outbrain.com"]);
let RunMRUWrites = DeviceRegistryEvents
| where Timestamp > ago(7d)
| where RegistryKey has @"Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU"
| project WriteTime = Timestamp, DeviceId, DeviceName, RegistryValueData;
let AdReferrals = DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has_any (AdExchangeDomains)
| project AdTime = Timestamp, DeviceId, RemoteUrl;
RunMRUWrites
| join kind=inner AdReferrals on DeviceId
| where WriteTime - AdTime between (0min .. 10min)
| project WriteTime, DeviceName, RegistryValueData, AdTime, RemoteUrlindex=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=13 TargetObject="*RunMRU*"
| rename _time as WriteTime
| join type=inner host
[ search index=proxy earliest=-7d
| where match(url, "(?i)(doubleclick\.net|googlesyndication\.com|googleadservices\.com|adnxs\.com|taboola\.com|outbrain\.com)")
| rename _time as AdTime, url as AdReferralUrl
| table host, AdTime, AdReferralUrl ]
| where (WriteTime - AdTime) >= 0 AND (WriteTime - AdTime) <= 600
| table WriteTime, host, Details, AdTime, AdReferralUrlAtomic Red Team Tests
Simulates the ClickFix payload execution stage by launching PowerShell with an encoded command directly from an explorer.exe context (via the Run dialog equivalent), validating Pillar 1 of the detection.
Command
powershell.exe -EncodedCommand JABhAD0AMQArADEAExpected Telemetry
Sysmon Event ID 1: Process Creation with Image=powershell.exe, ParentImage=explorer.exe (when run manually via Win+R), CommandLine containing '-EncodedCommand'.
Expected Detection
KQL/SPL Pillar 1 fires on InitiatingProcessFileName=explorer.exe with FileName=powershell.exe and CommandLine matching '-enc'/'-encodedcommand', SuspicionReason=ExplorerSpawnedScriptInterpreterWithObfuscatedCommand. For an authentic parent-process match, execute via the Win+R Run dialog rather than a script-launched shell.
Generates a DNS/HTTP resolution to a known ad-exchange domain, then immediately launches a script interpreter, exercising the Pillar 2 join logic that correlates a recent ad referral with an explorer-spawned interpreter within a 5-minute window.
Command
powershell.exe -Command "Resolve-DnsName 'googlesyndication.com' -Type A -ErrorAction SilentlyContinue; Start-Sleep -Seconds 2; mshta.exe javascript:close();"Expected Telemetry
DeviceNetworkEvents/DNS telemetry showing resolution of googlesyndication.com, followed within seconds by a Sysmon Event ID 1 process creation for mshta.exe with a 'javascript:' command line.
Expected Detection
KQL/SPL Pillar 2 fires when the mshta.exe spawn's parent is explorer.exe and the ad-exchange referral timestamp precedes it within 5 minutes, SuspicionReason=ClickFixLureFollowingMalvertisedAdReferral. Adjust to launch mshta.exe from an explorer.exe context (Run dialog) for an exact parent-process match.
Writes a synthetic RunMRU registry value simulating the forensic artifact left when a user pastes and executes a command via the Windows Run dialog, validating the registry-based hunting query independent of the process-tree detection.
Command
reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU" /v a /t REG_SZ /d "mshta.exe javascript:close();\1" /fCleanup
reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU" /v a /fExpected Telemetry
Sysmon Event ID 13 (Registry Value Set) for TargetObject containing 'RunMRU', with the synthetic command string in RegistryValueData/Details.
Expected Detection
Validates the shape of data the second hunting query expects (RunMRU write correlated to a preceding ad-exchange referral); it does not fire the primary KQL/SPL detections directly since it writes the registry value without an actual process spawn.