DOUBLECUP — ClickFix clipboard-paste-execute pattern

Ankit Mehta@Secvyn

•updated Aug 5, 2026•9•0•8

This rule detects potentially malicious command-line execution patterns often observed in 'ClickFix' or similar clipboard-based attack campaigns. It monitors for instances where standard Windows interpreters (PowerShell, cmd.exe, mshta.exe) are launched by legitimate shell processes (explorer.exe, rundll32.exe) and execute specific commands (like certutil for decoding) to process content found in suspicious or user-writable locations such as AppData or containing file extensions like .png (often used for steganography or file hiding).