【Attention】 What is ClickFix? "Allow vulnerabilities" that organizations should address and how to use Microsoft Defender

**What is ClickFix? **

ClickFix is a phenomenon in which a user unintentionally performs an operation such as "allow" or "execute" on malicious software or script, resulting in a security breach.

This is not a technical zero-day, but the essence of vulnerabilities due to "human error in judgment", which is especially often overlooked by companies.

Real-life example: ClickFix case in action

Case (1) Malware disguised as a business efficiency tool

• Employees install .exe files that are considered useful tools
• Confirm "Allow Firewall Exceptions" and other confirmations with "Yes"
• Suspicious C2 communication via PowerShell and detected by MDE at a later date
• 'schtasks' were also used to make them resident

⇒ Typical examples of "user-approved malware" that slipped through EDR

Case (2) Latent Resident Process Using xpcproxy on macOS

• Install external apps on a development Mac device with a GUI
• Scripts under '/tmp' are in a periodic execution state starting from 'xpcproxy'
• Discovery from the process chain in Defender for Endpoint

**⇒ ClickFix, which also occurs on macOS. If it is "allowed" through the GUI, it may not be blocked by MDE. **

Measures Companies Should Take

1. Limiting User Permissions

• Local admin privileges revocation (controlled by LAPS or Intune)
• Prohibition of unauthorized software installation
• PowerShell and Terminal Restrictions and Auditing

2. Implementing Application Control

• AppLocker and Windows Defender Application Control (WDAC)
• Apply restricted software policies in Intune GPO

3. Deploy Microsoft Defender for Endpoint (MDE)

• Track suspicious process relationships with DeviceProcessEvents
• Visualize suspicious communications from curl/powershell/wscript, etc. with DeviceNetworkEvents
• Protection not only by signatures but also by behavioral detection

24-hour risk response system with SOC monitoring

ClickFix is an "undetected" risk, so it is extremely important to have a monitoring system after implementing EDR.

The Need for 24/365 Monitoring

• If security controls are bypassed by employee operation, immediate anomaly detection and containment are required.
• Collaboration with the SOC (Security Operation Center) to automate the process of responding to alerts→ analysis→ and response systems.

Consultation and Implementation Support

• Helping you deploy Microsoft Defender for Endpoint
• Best practices for EDR operations, including ClickFix measures
• 24-hour SOC service linkage

Please contact Colorkrew Security.