T1204.001: ClickFix Win+R PowerShell IEX/IRM Remote Script Execution

Tim Peck@timpeck

•updated Sep 22, 2026•9•2•39

Detects the insertion of a PowerShell download cradle command into the Windows Explorer RunMRU registry key. This activity is indicative of the 'ClickFix' technique, where a user is socially engineered to copy and paste a malicious command into the Windows Run dialog box.