ClickFix: Obfuscated PowerShell Downloads configuration.ps1 from mnl.ac

Arnold Chan@slaz

•updated Sep 18, 2026•0•0•2

This rule detects the execution of PowerShell or Command Prompt processes that attempt to bypass execution policies while performing file downloads from suspicious domains (mnl.ac) or IP addresses (149.255.35.135). It also flags the use of common web-request cmdlets (Invoke-WebRequest, IWR, DownloadString, DownloadFile) to fetch scripts named 'configuration.ps1'. The rule includes detection for obfuscated commands using caret (^) symbols often used to evade keyword-based security filters.