ClickFix Infrastructure and BITS Abuse Detection

Paul P@ppritch

•updated Feb 25, 2026•7•0•88

This rule identifies network connections or BITS transfer jobs targeting specific IP addresses and URLs associated with recent ClickFix campaigns. It also detects the use of system utilities like bitsadmin.exe and powershell.exe to download files, a common tactic for these threats.