Suspicious Command Execution Associated with ClickFix

Aaron Mog@AaronMogS2S

•updated Jul 11, 2025•1•1•50

Detects suspicious command-line activity associated with the "ClickFix" social engineering technique. Threat actors trick users into pasting and executing malicious commands that typically use scripting engines or built-in utilities to download and run subsequent payloads. This rule identifies patterns seen in recent NetSupport RAT, Latrodectus, and Lumma Stealer campaigns using this vector.