Detection for ClearFake / Paste-and-Run Activity

Ankit Mehta@Secvyn

•updated Jun 9, 2026•3•0•15

Detects browser processes launching PowerShell, CMD, MSHTA, or WScript. This behavior aligns with ClearFake-style social engineering campaigns that instruct users to copy and execute malicious commands.