ClickFix - Invoke-WebRequest Executed from Explorer Context

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•1

This rule detects instances where 'Invoke-WebRequest' (or its aliases 'IEX', 'IWR') is executed by 'powershell.exe' directly from 'explorer.exe'. This pattern is often indicative of a user launching a malicious PowerShell command from the Run dialog, clipboard, or a shortcut, rather than within a legitimate script context. This specific detection is linked to the ClickFix campaign, which uses information stealers.