ClickFix Clipboard Access via PowerShell

nomit vyas@xoxo

•updated Jun 25, 2026•4•0•20

Detects ClickFix-style attacks where users are social-engineered into pasting malicious PowerShell commands into the Windows Run dialog (explorer.exe). The rule specifically monitors for powershell.exe being initiated by explorer.exe with command-line arguments involving clipboard access (Get-Clipboard) or web-based script retrieval/execution (iwr, iex).