huntrule

Suspicious Lampion ClickFix PowerShell Download and Execute via Run Dialog

PremiumReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
HuntRule
Published
2026-10-20
Updated
2026-10-20
AnalysisDetection

ATT&CK techniques

Execution

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects PowerShell spawned from the Windows Run dialog that combines Invoke-WebRequest with Start-Process to download and launch a payload. This pattern is used by the Lampion banking malware ClickFix campaign that tricks users into pasting a malicious one-liner. Attackers abuse this social-engineering vector to gain initial code execution while blending into normal user activity.

Reporting behind it

Related detections9 linkedT1059.001 — drag to rearrange
Suspicious cmd.exe Launching Encoded PowerShell From Shortcut File
Suspicious Encoded PowerShell Spawned from Explorer via ClickFix
Malicious Office Application Spawning Command Interpreter
Suspicious Office Application Spawning Script Interpreter
Suspicious Microsoft Word Spawning PowerShell
Malicious Office Application Spawning PowerShell with Encoded Command
Suspicious PowerShell String Concatenation Obfuscation for Batch Extension via LNK (via process_creation)
Suspicious Encoded JScript Execution via WScript (via process_creation)
Suspicious Batch Fake Installer Spawning PowerShell Downloader via OXLoader
Suspicious Lampion ClickFix PowerShell Download and Execute via Run Dialog
Pivot detection · T1059.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.