ClickFix: PowerShell spawned from explorer.exe via Run dialog with IEX/IRM

Ibrahim Saud@tektrix

•updated Sep 22, 2026•5•0•11

Detects suspicious PowerShell process executions initiated by Windows Explorer that include command-line arguments typically used for downloading and executing content from the internet. This pattern is commonly associated with fileless malware execution or malicious script droppers.