ClickFix Social Engineering: Explorer-Spawned Script Execution via Run Dialog
Detects instances where the Windows Explorer process (explorer.exe) spawns common script interpreters or command-line tools such as PowerShell, cmd.exe, mshta.exe, wscript.exe, or cscript.exe. This behavior is atypical for normal user activity and is frequently associated with malicious activity, including post-exploitation, code execution, or defense evasion.
Cortex XDR
