ClickFix: explorer.exe spawns PowerShell with encoded/obfuscated args

Ibrahim Saud@tektrix

•updated Sep 18, 2026•3•0•2

Detects instances of PowerShell being launched directly from Windows Explorer (explorer.exe) using suspicious command-line arguments. This pattern is commonly associated with malicious scripts, remote access trojans, or fileless execution techniques where an adversary executes code through shell-based file interaction.