ClickFix PowerShell iex(irm) Execution via Run Dialog from explorer.exe

Ibrahim Saud@tektrix

•updated Jul 3, 2026•5•0•13

Detects the execution of PowerShell with a suspicious download cradle pattern ('iex(irm)') that includes '-UseBasicParsing'. The process is specifically monitored when spawned from the Windows Run dialog (explorer.exe), a behavior frequently associated with the ClickFix social engineering campaign where users are tricked into executing malicious commands under the guise of fake security verification.