ClickFix - Encoded PowerShell Spawned from explorer.exe or cmd.exe

Ankit Mehta@Secvyn

•updated Jun 27, 2026•1•0•4

Detects the execution of PowerShell with an encoded command flag when spawned directly from explorer.exe or cmd.exe. This pattern is frequently used in 'ClickFix' style attacks where users are tricked into copying and pasting malicious, obfuscated PowerShell code into the Windows run dialog or command prompt.