ClickFix: explorer.exe spawns obfuscated PowerShell via Run Dialog

Arnold Chan@slaz

•updated Sep 18, 2026•0•0•2

This rule monitors for suspicious PowerShell command-line activity originating from Windows Explorer (explorer.exe) or embedded within RunMRU registry modifications. It detects obfuscated or hidden command execution patterns, such as base64 encoding, the use of -EncodedCommand, Invoke-Expression, or execution policy bypass flags, which are commonly associated with malicious scripts and fileless malware execution.