ClickFix Social Engineering Pattern Detection

Ethan Andrews@eandrews

•updated Feb 11, 2026•17•0•93

This detection identifies a pattern associated with the 'ClickFix' social engineering technique, where a user is tricked into copying a malicious command and pasting it into a PowerShell terminal. The query correlates a recent clipboard operation with a subsequent suspicious PowerShell execution by the same user on the same device.