ClickFix: explorer.exe spawns PowerShell via Win+R paste with RunMRU artifact

Ibrahim Saud@tektrix

•updated Jul 3, 2026•6•0•21

Detects the 'ClickFix' social-engineering pattern where an adversary tricks a user into opening the Windows Run dialog (Win+R) and pasting a malicious command. This is identified by monitoring for powershell.exe spawned directly by explorer.exe that correlates in time with a new RunMRU registry entry.