T1218.005: ClickFix mshta JScript Downloader via XMLHTTP, ADODB.Stream and WScri

Tim Peck@timpeck

•updated 7 days ago•3•0•26

Detects mshta.exe launched with an inline javascript: one-liner that chains MSXML2.XMLHTTP to download, ADODB.Stream to write to disk, and WScript.Shell to execute. This identifies the ClickFix social engineering variant that fetches and executes payloads without using PowerShell.