ClickFix: Run-dialog spawned PowerShell/mshta with hidden/encoded execution

Ibrahim Saud@tektrix

•updated Sep 26, 2026•2•0•10

Detects the execution of script interpreters (PowerShell, Cmd, Mshta) launched directly from common web browsers (explorer, chrome, edge, firefox). The rule specifically flags common obfuscation techniques such as encoded commands, hidden window styles, or attempts to download and execute code (e.g., IEX, DownloadString) while excluding explicit file-based script executions.