ClickFix Social Engineering Pattern Detection

nomit vyas@xoxo

•updated Jun 22, 2026•6•0•14

This detection identifies a pattern associated with the "ClickFix" social engineering technique, where a user is tricked into copying a malicious command and pasting it into a PowerShell terminal. The query correlates a recent clipboard operation with a subsequent suspicious PowerShell execution by the same user on the same device.