ClickFix-style PowerShell Execution via Win+R Run Dialog

Ibrahim Saud@tektrix

•updated Sep 24, 2026•0•0•2

Detects instances where explorer.exe (the Windows Shell) spawns a PowerShell process with suspicious flags, commonly associated with 'ClickFix' social engineering attacks where users are prompted to copy and paste malicious commands into the Windows Run dialog.