Microsoft ClickFix PowerShell/MSHTA from Explorer Run Dialog

Daniel Jeremiah@daniyyell

•updated Feb 20, 2026•0•23

This rule detects the execution of PowerShell, pwsh, mshta, or curl initiated by explorer.exe (specifically from the Run dialog) when the command line contains indicators of web requests, expression invocation, or encoded commands. This behavior is often associated with the 'ClickFix' social engineering technique, where users are tricked into running malicious one-liners from the Windows Run dialog. The rule looks for common PowerShell commandlets like 'Invoke-WebRequest', 'Invoke-Expression', or their aliases, as well as '-EncodedCommand' or methods like 'DownloadString' and 'FromBase64String', indicating an attempt to fetch and execute remote content or obfuscated commands.