ClickFix: explorer.exe spawns obfuscated cmd/PowerShell via Run dialog

Ibrahim Saud@tektrix

•updated 27 days ago•1•0•3

Detects execution of PowerShell or CMD commands originating from Windows Explorer (explorer.exe) that exhibit characteristics of malicious command-line obfuscation, such as encoded commands, bypass flags, or caret-based character obfuscation.