ClickFix PowerShell Execution via Run Dialog

Paul P@ppritch

•updated Feb 25, 2026•3•1•108

Detects PowerShell processes launched by Windows Explorer, which is characteristic of a user executing a command from the 'Run' dialog (Win+R). The detection targets command lines associated with the "ClickFix" social engineering technique, which tricks users into running malicious code. This includes looking for encoded commands or specific strings from the "reCAPTCHA Phish" toolkit.