ClickFix Series: Clipboard-to-Terminal Payload Execution via Get-Clipboard or cl

Ibrahim Saud@tektrix

•updated 8 days ago•0•0•0

Detects execution patterns indicative of 'ClickFix' social engineering, where a user is tricked into copying a command to their clipboard and executing it directly in a terminal. The rule monitors for processes that read clipboard contents (via PowerShell or clip.exe) and simultaneously invoke shell interpreters to execute the retrieved data.