ClickFix: explorer.exe spawns obfuscated PowerShell via Run dialog

Ibrahim Saud@tektrix

•updated 27 days ago•0•0•6

Detects the initiation of PowerShell by the Windows Explorer process (explorer.exe), which is often indicative of malicious activity such as lateral movement or execution of scripts originating from user-triggered actions. The rule flags command lines containing obfuscated patterns, bypass arguments, or encoded commands.