ClickFix is a social-engineering technique that asks a user to copy and run a command on their computer. Arsen reproduces this behavior safely to measure whether employees follow the instructions.
A compromise is recorded only when the employee runs the copied command and the safe callback reaches Arsen.
⚠️ Important: Email allowlisting and EDR allowlisting are separate. Your email configuration must deliver the simulation, while your endpoint and network controls must allow the ClickFix callback.
1 – Before you start
Make sure Arsen simulation emails are already authorized, the phishing landing hostname can be opened from the target devices, and your security team can update the EDR, DNS, proxy, or firewall policies.
Start with one or two pilot users in a dedicated device group before applying the configuration more widely.
2 – How an Arsen ClickFix campaign works
The employee receives a simulation email and opens a realistic verification page. The page copies a command adapted to the employee’s operating system and asks them to run it in PowerShell or a terminal.
The command sends one HTTPS GET request to Arsen. It does not download malware, install a file, request credentials, create persistence, or change a security setting.
3 – ClickFix callback
Arsen uses the following callback:
https://cf.arsen.report/cf?pid=<target_id>&fp=<fingerprint>
On Windows, the request is sent with PowerShell and Invoke-WebRequest. On macOS, Arsen uses curl; on Linux, it uses wget.
💡 Note: The pid and fp values change for every simulation. Do not use the complete callback from one pilot user in a static rule.
4 – Why an EDR may block the command
EDRs monitor PowerShell and command-line network requests because attackers frequently abuse them. The hidden PowerShell window, a command copied from a website, or the connection to a new destination may therefore trigger a prevention rule.
This is expected. The objective is to authorize the Arsen simulation without allowing unrelated PowerShell or terminal activity.
5 – Allow ClickFix in your security controls
Step 1 – Allow the callback
Allow outbound HTTPS on TCP port 443 to cf.arsen.report.
Step 2 – Allow the landing page
Allow the exact phishing landing hostname used by your scenario. If URL path rules are supported, allow https://cf.arsen.report/cf?*.
Step 3 – Run a pilot
Send a campaign to one or two pilot users. If the command is blocked, open the EDR incident and identify the detecting engine, rule, command line, and mitigation action.
Step 4 – Create a narrow exception
Create an exception for the Arsen callback and the detection observed during the pilot. If supported, use a Detect, Monitor only, or Do not block policy for the pilot group.
Step 5 – Remove temporary changes
After the campaign, restore your normal policy and remove temporary exceptions.
⚠️ Important: Do not exclude all PowerShell activity, powershell.exe, curl, wget, or an entire system directory. The Arsen simulation does not download a payload, so there is no file hash to allowlist.
6 – Validate the configuration
Send a ClickFix campaign to a pilot user.
Confirm that the email and landing page open correctly.
Complete the instructions and run the copied command.
Confirm that Arsen records a compromise event.
Confirm that the EDR retains the telemetry without preventing the callback.
Only extend the configuration after the pilot works as expected.
7 – Troubleshooting
The landing page is blocked. Allow the selected phishing hostname in your DNS filter, proxy, firewall, and browser controls.
The command is terminated. Open the EDR incident and create an exception for the specific detection.
The command runs but no compromise is recorded. Verify DNS resolution and outbound HTTPS access to cf.arsen.report. If you use an authenticated proxy, confirm that command-line tools can access it.
8 – Vendor-specific EDR integrations
8.1 – SentinelOne
SentinelOne may detect the Windows ClickFix command through Behavioral AI or Documents & Scripts. Configure the exception in a dedicated group so it applies only to authorized campaign participants.
Step 1 – Create a pilot group
Create a temporary group in SentinelOne, add one or two pilot devices, and apply a copy of your normal endpoint policy.
Step 2 – Allow the callback
In Firewall Control, allow outbound TCP 443 to cf.arsen.report for the pilot group. If another proxy or firewall controls web access, create the rule there instead.
See SentinelOne’s Firewall Control overview.
Step 3 – Identify the blocking engine
Run one pilot simulation. Open the resulting SentinelOne incident and record the detecting engine, confidence level, command line, and mitigation action.
Step 4 – Create a command-line exclusion when available
If your tenant provides a Command Line or CLI exclusion, create a group-scoped exclusion containing:
Invoke-WebRequest -Uri 'https://cf.arsen.report/cf?pid=
Do not include the complete pid or fp values because they change for every simulation.
Step 5 – Escalate if the command is still blocked
Do not switch Behavioral AI or Documents & Scripts from Protect to Detect solely to allow the simulation. Ask your SentinelOne administrator or SentinelOne Support to review the pilot incident and create the narrowest supported, group-scoped exception.
If your security team approves a temporary Detect-mode test, limit it to one isolated test endpoint, keep it away from sensitive resources, monitor it throughout the test, and restore Protect immediately afterwards.
SentinelOne documents that Detect mode allows activity to continue while retaining telemetry in its Behavioral AI overview.
Step 6 – Validate the result
Run the simulation again. Confirm that Arsen records the compromise and that SentinelOne retains the incident without terminating PowerShell.
Step 7 – Restore protection
After the campaign, restore Protect mode and remove the temporary exclusion.
⚠️ Important: Do not exclude powershell.exe by path, hash, or Microsoft certificate. This would authorize unrelated PowerShell activity. Review SentinelOne guidance: https://www.sentinelone.com/faq/
💡 Note: SentinelOne menu names may vary by console version and license. If the command remains blocked, provide the pilot incident details to your SentinelOne administrator or SentinelOne Support.