ClickFix: PowerShell/cmd/mshta Spawned from Browser Process

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

This rule detects instances where common web browsers (Chrome, Edge, Firefox, IE, Brave, Opera) spawn common administrative or scripting shells (PowerShell, CMD, mshta, wscript, cscript). This pattern is frequently indicative of drive-by downloads or malicious file execution triggered by social engineering, where an attacker leverages the browser process to spawn execution environments to run malicious scripts or payloads.