Script Host Launched by Run Dialog or Browser (ClickFix Technique)

Daniel Jeremiah@daniyyell

•updated Feb 20, 2026•0•19

This rule detects the execution of script hosts (PowerShell, wscript, cscript) that are launched by either the Windows Run dialog (rundll32, dllhost) or common web browsers (Chrome, Microsoft Edge, Firefox). The script host execution is further narrowed down by looking for command-line arguments indicative of script execution, such as encoded commands or invocation of functions like 'Invoke-' or 'IEX('. This pattern is often associated with the 'ClickFix' social engineering technique where users are tricked into pasting malicious commands into the Run dialog or clicking links that trigger script execution from a browser.