FakeCaptcha Clipboard String Execution

Ibrahim Saud@tektrix

•updated Jun 17, 2026•0•0•6

Detects PowerShell executing base64 encoded payloads or the string "I am not a robot" typically associated with FakeCaptcha malware found in the clipboard. This rule specifically looks for these indicators within the process command line of PowerShell or pwsh processes.