ClickFix - Rundll32 JavaScript Execution

Georg Lauenstein@gsec

•updated 5 days ago•3•0•6

Detects rundll32.exe executing inline JavaScript/VBScript via the mshtml RunHTMLApplication export or a script payload staged in user-writable directories. ClickFix chains abuse rundll32 to proxy script execution past application controls without dropping a conventional executable.