Tips and tricks for hunting ClickFix

Notes from SANS Stay Ahead of Ransomware Livestream April 2026 episode :)

1. Suggestion: Trim & strip escape characters
   • Suggest trimming + stripping escape characters and other DOSfuscation-type characters to maximize your string-based queries and avoid falling for escape character pitfalls
   • Use trim or ltrim|rtrim depending on your E/XDR

| make_a_new_field_for_me registry_data = replace(registry_data, "\"", "")
| make_a_new_field_for_me registry_data = replace(registry_data, "^", "")
| make_a_new_field_for_me registry_data = replace(registry_data, "'", "")
| make_a_new_field_for_me registry_data = replace(registry_data, "+", "")

2. Combine your ClickFix & FileFix hunting by looking not only at RunMRU key, but also at TypedPaths
   • FileFix attacks may have uses put command into the Explorer.exe address bar, which may be logged in TypedPaths in the Windows Registry

| filter (lowercase(action_registry_key_name) contains "software\microsoft\windows\currentversion\explorer\runmru"
        and lowercase(action_registry_value_name) not in (null,"mrulist"))
    or lowercase(action_registry_key_name) contains "software\microsoft\windows\currentversion\explorer\typedpaths"

• Doesn't hit all FileFix options, but adding TypedPaths is an easy win for your current CF hunts

3. Focus on the most common processes associated with RunMRU activity:
   • Ryan's list: (%comspec%|bash|bitsadmin|certutil|cmd|conhost|curl|echo|mshta|msiexec|powershell|pwsh|regsvr32|rundll32|wscript)
   • For a solid Sigma rule, see https://for528.com/clickfix-sigma

Bonus: Disabling Win+R

ClickFix mitigation to disable Win+R:

reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v DisabledHotkeys /t REG_SZ /d R /f