huntrule

Suspicious PowerShell Download Spawned From Explorer via ClickFix (via process_creation)

PremiumReviewedSigma · Medium · v1
Category
process_creation
Author
HuntRule
Published
2026-10-20
Updated
2026-10-20
AnalysisDetection

ATT&CK techniques

Execution

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects PowerShell launched directly by Explorer with download cmdlets, matching the ClickFix social engineering technique where a victim pastes a malicious command into the Windows Run dialog. The IUAM ClickFix Generator produces lures that trick users into self-executing payload downloaders. Detecting this pattern catches the delivery of DeerStealer and similar infostealers at execution.

Reporting behind it

Related detections9 linkedT1059.001 — drag to rearrange
Suspicious Lampion ClickFix PowerShell Download and Execute via Run Dialog
Suspicious cmd.exe Launching Encoded PowerShell From Shortcut File
Suspicious Encoded PowerShell Spawned from Explorer via ClickFix
Malicious Office Application Spawning Command Interpreter
Suspicious Office Application Spawning Script Interpreter
Suspicious Microsoft Word Spawning PowerShell
Malicious Office Application Spawning PowerShell with Encoded Command
Suspicious PowerShell String Concatenation Obfuscation for Batch Extension via LNK (via process_creation)
Suspicious Encoded JScript Execution via WScript (via process_creation)
Suspicious PowerShell Download Spawned From Explorer via ClickFix (via process_creation)
Pivot detection · T1059.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.