ClickFix - Memory-Only Payload Execution via IEX (T1059.001)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•1

Identifies the execution of IEX (New-Object Net.WebClient).DownloadString directly from a run prompt, avoiding disk writes entirely. This rule specifically looks for PowerShell command-line activity where 'IEX' is used in conjunction with 'New-Object Net.WebClient).DownloadString', indicating an attempt to download and execute content directly in memory.