ClickFix, after the paste: the persistence it leaves behind

Let me get the boundary out of the way first, because this topic attracts overclaims like a porch light attracts moths: RFF is not EDR. It does not detect ClickFix and it does not block it. If you came here for “stop ClickFix with one weird config tool,” close the tab - your endpoint security owns that job.

What this post is about is the part of the attack that gets far less airtime: what ClickFix leaves on the box after the paste, and why that residue happens to be visible to the most boring tool in your stack - fleet inventory.

The attack everyone describes stops at the paste

You know the setup by now. A fake CAPTCHA (“verify you’re human”), a fake error page, a booby-trapped doc. It tells the user: press Win+R, press Ctrl+V, press Enter. The clipboard holds the payload - a powershell -w hidden one-liner, an mshta call, a curl-to-iex chain. The user runs it themselves, on their own box, with their own token.

No CVE. No attachment for the mail gateway. No dropper crossing the perimeter. The human is the delivery mechanism, which is why every network-shaped defense you own watched it happen and logged nothing.

That’s where most writeups end: scary paste, game over. But the paste is the beginning of the attacker’s problem, not the end of yours.

The payload’s problem: surviving Tuesday

A one-liner in a user’s session dies with the session. Laptops get closed. Boxes get rebooted. Patch night happens. An access broker who paid for that click wants to still be there next week, so within seconds of the paste, the payload almost always does some combination of very old-fashioned things:

writes itself into an autorun - an HKLM or HKCU Run key, or a shortcut in a Startup folder
registers a scheduled task, because tasks survive reboots and run as whoever they’re told to
occasionally, on boxes where the token allows it, adds a local administrator so the foothold outlives the stolen session entirely

Here’s the thing about all three: they are not exotic telemetry. They’re registry keys, task XML, and group membership - inventory-grade facts, the same class of boring data your fleet tooling already reads to tell you what version of Chrome is installed. The attack’s delivery is invisible to config tooling. Its persistence is config.

What RFF actually does about it (three layers, none of them “protection”)

1. Turn on the logging that shows what ran

The first ClickFix baseline RFF ships is deliberately the least glamorous one: PowerShell script-block logging, on, fleet-wide. It claims to stop nothing - that’s why I like it. With it on, Windows writes every executed script block to the event log de-obfuscated (event 4104), so if a box does get hit, you pull the exact PowerShell that ran instead of reconstructing it from vibes. Near-zero user disruption, safe to deploy everywhere, and “we turned on the forensics” is a sentence you can say to an auditor with a straight face.

It ships as a named Conformance baseline, which matters more than it sounds: a logging setting someone enabled in 2023 and a logging setting that’s proven on, on every box, this quarter are different things. RFF diffs the fleet against the baseline and tells you when a re-image or a rogue GPO quietly turned it back off.

2. Shrink the surface - with the disruption priced in honestly

Two more baselines exist, and both are opt-in on purpose:

Disable the Run dialog (NoRun). It kills ClickFix’s #1 lure and it will also generate an angry ticket from every admin who lives in Win+R. It covers the Run-dialog vector only - not the address-bar or Start-search variants. High disruption, partial coverage: that’s a setting you scope to a group deliberately, not one we’d slip inside a friendly one-click button.
Disable Windows Script Host, which closes the wscript/cscript payload path. Moderate disruption - some shops still have legacy scripts that will feel it.

Report-only first, enforcement approval-gated, rollback captured before anything writes. If an active GPO already owns a value, RFF reports that instead of fighting a policy engine that will just reimpose it every ninety minutes.

3. See the persistence - as facts, not verdicts

This is the piece the persistence story earns. RFF’s agent now inventories autoruns, scheduled tasks, and local-admin membership, and the fleet Changes feed diffs every snapshot against the last one. So the residue from section two shows up as plain entries in one chronological feed:

New autorun on DESKTOP-4F2: HKCU\...\Run\Updater → powershell.exe -w hidden -enc ... New scheduled task on DESKTOP-4F2: \MicrosoftEdgeUpdateTaskCore Local Administrators changed on DESKTOP-4F2: was 2 members, now 3

Notice what’s missing: a threat score. A “⚠️ suspicious privilege escalation” banner. We wrote a hard rule into this feature - report, never score - because the moment a config tool starts issuing verdicts on EDR-shaped data, it’s pretending to be EDR, and it will be worse at that job than the products whose whole existence is that job. “A new local admin appeared” is a fact we can stand behind on every box, every time. Whether it’s your intern’s PAM rollout or an intruder is a call you make, with context we don’t have.

One honesty note on RunOnce: attackers use it, and Windows also uses it constantly as a scratchpad, so the feed suppresses RunOnce churn by default with an opt-in to track it. A visibility feature that cries wolf hourly isn’t visibility, it’s a muted tab.

Where each layer lives

The forensics and surface-shrinking baselines ride Conformance, which is the paid tier - hardening-and-keeping-it-hardened has always been RFF’s paid line. The Changes feed and its daily digest are free, same line we’ve drawn everywhere from shadow AI on down: seeing what’s happening on your own fleet shouldn’t cost money; automation and enforcement can.

And to close where I opened: none of this stops a determined user from pasting. EDR catches payloads; this shrinks the surface, records what ran, and surfaces what stuck around. That’s three true sentences instead of one false one, and after twenty years of vendor decks I know which I’d rather buy.

The full breakdown of what the baselines set (and what they deliberately don’t) is at /clickfix-hardening - or start free and seed the forensics baseline against your own fleet in about five minutes.