ClickFix: Browser or MSHTA Spawning Hidden PowerShell with Encoded/Download Patterns

Ibrahim Saud@tektrix

•updated Jun 30, 2026•2•0•2

This rule detects instances where common web browsers (chrome.exe, msedge.exe, firefox.exe, iexplore.exe) or mshta.exe spawn shell processes (powershell.exe, pwsh.exe, cmd.exe) with suspicious command-line arguments. These arguments often indicate malicious activity such as downloading and executing code, using encoded commands, or hiding the execution window, which are typical indicators of a web-based delivery or exploitation attempt.