How Huntress Detects and Responds to a ClickFix Attack

What it is

This is a follow-up/defense post by Huntress rather than a pure technical writeup — it argues why the detection architecture must be agent-local, not backend, and adds the fix for a specific evasion (the start-detach variant) plus the efficacy bar the rules must clear before enforcement. The core incident details (caret-obfuscated finger.exe cradle, Unicode padding, 1.25s/4-process kill) are already in the summary.

How it works

The detachment problem: some ClickFix variants wrap the payload-fetch step in start, which spawns it as a new process detached from its parent. Killing the parent (as the original rule did) leaves the detached child — the actual payload retrieval — running in a fresh process chain. The fix is a second rule that matches on the parent's command line but kills both parent and child together, so the detection no longer depends on recognizing what the payload process calls itself. This incidentally also defeats randomly-renamed runners used for evasion.

Preconditions / Affected

Windows only — the Run-dialog/explorer.exe parent gate and the LOLBin surface (finger.exe, cmd.exe) described are Windows-specific. The author states Huntress does not claim coverage for ClickFix-style social engineering on other platforms.

What to do

• Rules ship in audit mode first, run across the full customer base for weeks, and are promoted to enforcement only if they clear a 99% accuracy bar — relevant context if evaluating any vendor's "enforce mode" claims rather than just detection claims.
• Reported platform-wide false-positive rate: under 1% across 5M+ endpoints; on this specific ruleset, only a handful of individual false positives have needed fixing (not a handful of percent).
• This is disruption (kills the execution chain), not prevention — it doesn't stop the user from pasting/running the command in the first place; the page points to Huntress Managed ESPM as the hardening control for that gap.
• When the on-agent kill loses the race (faster-than-detection chains), backend detection still fires but produces an investigation for a SOC analyst rather than an automatic kill.

Caveats

The page explicitly states coverage is incomplete and evolving: attackers rotate LOLBins and obfuscation, and named emerging variants (FileFix, TerminalFix, DownloadFix) each require new pattern work. No claim of total coverage is made, and the detachment fix described was itself a correction of an earlier gap in the original ruleset.