ClickFix: hidden-window base64 PowerShell via Run dialog (RunMRU)

Ibrahim Saud@tektrix

•updated 22 days ago•0•0•4

This rule detects potentially malicious PowerShell activity executed from Windows Explorer with obfuscated arguments (-enc, -w hidden) in conjunction with access to the Windows RunMRU registry key, which tracks commands executed via the Windows Run dialog.