Browser Spawning CMD with ClickFix Command

Daniel Jeremiah@daniyyell

•updated Jun 19, 2026•0•0•5

This rule detects instances where a web browser (Chrome, MS Edge, Firefox, or Brave) spawns a command prompt (cmd.exe) with a suspicious command line. The command line is characterized by containing a long string (at least 40 characters) within the user's temporary directory (%temp% or \temp\) and multiple command separators (&&, & rem, tar -xf, or rundll32). This pattern is indicative of the 'ClickFix' attack, often involving malicious copy-pasting from a browser into a command prompt.