Browser-Spawned Msiexec with Suspicious Arguments (ClickFix)

g host@ghosty

•updated Mar 20, 2026•15•1•234

Detects 'msiexec.exe' being launched from a web browser with a command line containing indicators of remote package download or path traversal. This is a primary indicator of the 'ClickFix' social engineering technique used by LeakNet and other threat actors.