Woodgnat ClickFix/FileFix/CrashFix PowerShell Execution via Teams or Browser

Ethan Andrews@eandrews

•updated Jun 24, 2026•4•0•9

Detects user-initiated PowerShell execution patterns associated with Woodgnat social engineering campaigns (ClickFix, FileFix, CrashFix). The rule monitors for PowerShell processes spawned by common communication and web browsing applications (Microsoft Teams, Chrome, Edge, Firefox) or script interpreters (mshta, wscript) that utilize obfuscation or non-interactive flags common in these attack vectors.