ClickFix PowerShell Execution

nomit vyas@xoxo

•updated Jun 23, 2026•1•0•9

Detects PowerShell execution with a command line indicative of a download cradle, initiated from the user's shell (explorer.exe). This behavior is characteristic of the "ClickFix" social engineering technique where a user is tricked into copying and running a malicious command from a webpage.