Potential TerminalFix Cloudflare Lure in PowerShell

Last updated 2 months ago on 2026-09-28

Created 2 months ago on 2026-09-28

About

Identifies PowerShell script blocks that print a fake Cloudflare verification lure. TerminalFix pages instruct the victim to paste a command into Windows Terminal or PowerShell. The script presents messages such as "Cloudflare verification", "Cloudflare ID:", or "I am not a robot" while it stages a payload. Review the full script block for download, extraction, and follow-on execution.

Tags

Domain: EndpointOS: WindowsUse Case: Threat DetectionTactic: ExecutionTactic: Initial AccessData Source: PowerShell LogsThreat: ClickFixRule Type: Custom Query (KQL)Platform: WindowsLanguage: kuery

Severity

high

Risk Score

MITRE ATT&CK™

Execution (TA0002)(external, opens in a new tab or window)

↳ Command and Scripting Interpreter (T1059)(external, opens in a new tab or window)

↳ User Execution (T1204)(external, opens in a new tab or window)

Initial Access (TA0001)(external, opens in a new tab or window)

↳ Drive-by Compromise (T1189)(external, opens in a new tab or window)

License

Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type: Query (Kibana Query Language)
Integration Pack: Prebuilt Security Detection Rules
Index Patterns: logs-windows.powershell*winlogbeat-*
Related Integrations: windows(external, opens in a new tab or window)
Query

✄𐘗text code block:
✄𐘗host.os.type:windows and event.category:process and
event.provider:("Microsoft-Windows-PowerShell" or "PowerShellCore") and
event.action:"Execute a Remote Command" and
powershell.file.script_block_text:(
  ("Clear-Host" or "Write-Host" or "Write-Output" or "Write-Warning" or "cls;" or echo or WriteLine) and
  ("Cloudflare ID:" or "Cloudflare Services respond" or "Cloudflare verification" or "I am not a robot" or "I'm not a robot")
)

Install detection rules in Elastic Security

Detect Potential TerminalFix Cloudflare Lure in PowerShell in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).