THE ONE CHOKEPOINT TO RULE THEM ALL: WHY I DELETED 50 CLICKFIX DETECTION RULES AND REPLACED THEM WITH ONE

Summary from the TLDR InfoSec newsletter

ClickFix attacks are a growing class of attacks that trick a user into executing a malicious command by prompting them to fix or otherwise diagnose a bogus issue. At the behavioral level, a ClickFix attack boils down to a browser process losing focus, followed by a native shell gaining focus, followed by a command containing a network call being executed within 60 seconds. The post contains this behavioral detection in several languages and a demonstration of it working against several variants.