ClickFix - Cmd LOLBin Payload Download via Run Dialog

Georg Lauenstein@gsec

•updated 6 days ago•4•0•8

Detects cmd.exe launched from the Windows Run dialog (explorer.exe parent) downloading a payload with a living-off-the-land transfer utility such as certutil, bitsadmin or curl. ClickFix pasted commands frequently chain cmd.exe with these built-in binaries to fetch the secondary malware stage.