ClickFix - Browser to Shell Context Transition (T1204.001)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•3

This rule detects a behavioral transition where an active browser session (Chrome or Edge) navigates to a URL containing deceptive captcha/verify/human keywords, immediately followed by the invocation of PowerShell within a 3-minute window, initiated by explorer.exe. This pattern is indicative of the ClickFix attack, where a user is tricked into interacting with a malicious website that then triggers a PowerShell execution.