ClickFix - Clipboard Access and Execution (T1059.001)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•2

Correlates the Get-Clipboard cmdlet execution natively invoked by the user shell, proving the "paste-to-run" ClickFix mechanism. This rule specifically looks for PowerShell execution of 'Get-Clipboard' where the initiating process is 'explorer.exe'.