T1566/T1059.001: ClickFix Script Execution via Browser-Spawned Interpreter

Tim Peck@timpeck

•updated Jun 25, 2026•0•0•5

Detects the ClickFix social engineering technique where a user is coerced into copying and executing a malicious script from a web browser. The rule identifies instances where common web browsers spawn script interpreters such as powershell.exe, cmd.exe, mshta.exe, or wscript.exe, which is characteristic of the user pasting malicious commands into a command prompt interface.