ClickFix detection: suspicious PowerShell commands launched from Explorer or browsers

Ankit Mehta@Secvyn

•updated Jun 29, 2026•1•0•3

Detects PowerShell processes launched by web browsers (Chrome, Edge, Firefox, Internet Explorer) or Windows Explorer, especially when using suspicious command-line arguments like encoded commands, Invoke-Expression, or web download functions. This behavior can indicate an attempt to execute malicious scripts, often initiated through user interaction (e.g., clicking a malicious link or opening a crafted file).