PowerShell Execution via File Explorer Address Bar or Run Dialog

Kaung Khant Ko@kaungkhantko

•updated Jun 25, 2026•0•0•2

Detects instances of PowerShell being launched directly by explorer.exe. This activity is a known indicator of 'ClickFix' or similar social engineering campaigns, where users are instructed by a deceptive website or lure to copy and paste malicious PowerShell commands into the Windows Run dialog or the File Explorer address bar to execute code.