ErrTraffic ClickFix PowerShell Decode

Thiru N@Iamthiru

•updated Jun 17, 2026•5•0•17

This rule detects the execution of PowerShell commands or script blocks that contain specific de-obfuscation patterns associated with the ErrTraffic/ClickFix malware. It looks for the presence of '-bxor' and '[convert]::ToInt32' within PowerShell command lines or script blocks, indicating an attempt to decode obfuscated content.