---
title: Tip: make ClickFix harder by blocking execution from user-writable folders and watching what the Run dialog launches | ctxsec
url: https://ctxsec.com/items/tip-block-clickfix-run-dialog-paste-and-user-writable-execution
description: "Huntress' advice after its latest ClickFix round-up: tell users that no real CAPTCHA asks them to paste a command, use application control to block unsigned binaries and execution from %TEMP% and other user-writable paths, limit local admin, and restrict the Run dialog and command prompt where people don't need them. Then alert on the follow-on steps: new scheduled tasks and Run keys, archives landing in Temp, and outbound SSH from endpoints."
status: "operational guidance (based on Huntress recommendations, Nov 10, 2026)"
published: 2026-11-10
---

> Huntress' advice after its latest ClickFix round-up: tell users that no real CAPTCHA asks them to paste a command, use application control to block unsigned binaries and execution from %TEMP% and other user-writable paths, limit local admin, and restrict the Run dialog and command prompt where people don't need them. Then alert on the follow-on steps: new scheduled tasks and Run keys, archives landing in Temp, and outbound SSH from endpoints.

[← Tips & Guides](/tips) · [markdown](/items/tip-block-clickfix-run-dialog-paste-and-user-writable-execution.md)

operational guidance (based on Huntress recommendations, Nov 10, 2026)

2026-11-10

### Tip: make ClickFix harder by blocking execution from user-writable folders and watching what the Run dialog launches

- On Windows, a GPO can remove the Run dialog for standard users, and WDAC or AppLocker rules can deny execution from %LOCALAPPDATA%\Temp and %PROGRAMDATA% subfolders that aren't on an allowlist.
- Pair the controls with an easy report path so users who did paste something tell IT fast.

Sources: [Huntress: Beyond the clipboard: The evolving tradecraft of ClickFix (Nov 10, 2026)](https://www.huntress.com/blog/the-evolving-tradecraft-of-clickfix)