PowerShell spawned from explorer.exe with hidden window or encoded command (ClickFix)

Ibrahim Saud@tektrix

•updated Jul 3, 2026•9•0•26

Detects the execution of PowerShell via explorer.exe using hidden windows styles and encoded commands. This behavior is often associated with fileless execution, initial access via malicious attachments or documents, and various obfuscation techniques used by adversaries to evade detection.