ClickFix Clipboard Hijack - cmd/PowerShell via explorer.exe RunMRU Abuse

Ankit Mehta@Secvyn

•updated Jun 29, 2026•1•0•2

Detects suspicious execution of command-line utilities (cmd, powershell, pwsh) spawned by Windows Explorer (explorer.exe). The rule flags processes with long command lines or those containing evidence of obfuscation (Base64 encoding) or common command-line indicators used for weaponized scripts, such as download requests or expression invocation.