How do you detect ClickFix and fake-CAPTCHA lures?

Detect ClickFix on the endpoint, since no file is delivered. Alert on suspicious values written to the Run dialog's RunMRU registry key (powershell, mshta, curl or a download cradle), on explorer.exe spawning powershell, mshta or cmd with hidden-window and iex or irm arguments, and on command lines padded with fake verification text. Reduce exposure by disabling the Run dialog for users who do not need it, restricting PowerShell for non-admins, and training users that no site should ask them to paste a command.

Detecting ClickFix and Fake-CAPTCHA Paste-and-Run Lures

ClickFix lures show a fake verification or error page and instruct the visitor to press Win+R, paste and press Enter. The page placed a one-line command on the clipboard, so the user runs it by hand. There is no attachment to scan, but the endpoint leaves clear traces: the Run dialog history, an interpreter launched from explorer and a command that downloads and executes.

Signals at a Glance

Signal	Where	ATT&CK
RunMRU value containing powershell, mshta, curl or a download cradle	Sysmon 13, registry telemetry	T1204
explorer.exe spawning powershell, mshta or cmd with hidden window and iex or irm	Sysmon 1, EDR	T1059.001
Command line carrying a fake verification comment (for example reCAPTCHA or Verification ID text)	Sysmon 1, EDR	T1059.001
Interpreter fetching a remote script moments after a browser visit to a rare site	Proxy, EDR network	T1105
Run dialog usage by users who never use it	Behaviour baseline	T1204

The Run Dialog Leaves a Trail

Commands entered in the Run dialog are recorded under the user's RunMRU key. Real users enter short program names; a long command with a download cradle or script host is distinctive:

title: Suspicious Command Stored in Run Dialog History
logsource:
  product: windows
  category: registry_set
detection:
  selection:
    TargetObject|contains: '\Explorer\RunMRU'
  content:
    Details|contains:
      - 'powershell'
      - 'mshta'
      - 'iex'
      - 'irm '
      - 'curl '
      - 'bitsadmin'
      - 'verification'
      - 'not a robot'
  condition: selection and content
level: high
# tune/validate: admins legitimately run short commands from Run; raise the bar with length or the presence of a URL.

Process and Command Line

The same event shows up as a process tree: explorer launches an interpreter with a hidden window and a command that retrieves and runs remote content. Pad-comment text, added to look like a verification step, is a strong signature of the current lure family:

// Defender XDR (KQL) - explorer.exe launching interpreters with download-and-run content
DeviceProcessEvents
| where Timestamp > ago(14d)
| where InitiatingProcessFileName =~ "explorer.exe"
| where FileName in~ ("powershell.exe","pwsh.exe","mshta.exe","cmd.exe","wscript.exe")
| where ProcessCommandLine has_any ("iex","invoke-expression","irm ","invoke-restmethod","downloadstring",
                                    "mshta http","curl ","-w hidden","-windowstyle hidden","-enc")
      or ProcessCommandLine matches regex @"(?i)(not a robot|recaptcha|verification id|human verification)"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine
| order by Timestamp desc
// tune/validate: IT launch scripts from Start menu shortcuts also have explorer as parent

Disable the Run dialog for general users where the business allows, using the Explorer NoRun policy, and review PowerShell constrained language mode for non-admin accounts.
Brief users with a single rule: no website legitimately asks you to paste a command into Windows. Give them a one-click report route.
Hunt browsers for pages that write to the clipboard on a click, using web-filtering categories for newly seen and low-reputation sites.
Search for the same lure family on macOS and Linux, where the command is pasted into a terminal rather than the Run dialog.

Vetted sources

Use SigmaHQ Run-key and RunMRU rules, Elastic's PowerShell-from-explorer detections, Microsoft threat intelligence write-ups on ClickFix and your web-filtering vendor's categories. Baseline your own environment — help-desk staff and admins use the Run dialog legitimately.

Build Detections That Fire

Mjolnir Security helps blue teams turn threat intelligence into high-fidelity detections across endpoint, network, identity and cloud telemetry.

Detection EngineeringManaged Detection & ResponseThreat HuntingIncident ResponsePurple Teaming

Detection Engineering We build and tune detections mapped to ATT&CK from your own telemetry.
Threat Hunting as a Service Hypothesis-driven hunts for the behaviours on this page.
24/7 Incident Response Containment when a detection fires. Call +1 833 403 5875.

Written by: Mjolnir Threat Research (MTAC)  |  Published: October 12, 2026  |  Last reviewed: October 12, 2026

Signals at a Glance

The Run Dialog Leaves a Trail

Process and Command Line

Build Detections That Fire

Phishing Delivery Detection

Detection Hub

Callback Phishing Detection

Phishing Landing Page Detection