Detects ClickFix-type abuse where a command copied from a browser is executed via the Windows Run dialog. The rule correlates Sysmon events that touch clipboard data (EventID 24) and RunMRU registry modifications (EventID 13) to identify when an user copies a browser command, pastes it into Run, and executes it. It filters to known browser processes, reconstructs the command from registry/clipboard data, decodes and normalizes it, then computes a SHA-256 hash of the decoded command. If multiple related events share the same command hash and destination user (dc_EventID > 1), it raises a finding. The approach relies on browser process names (Chrome, Edge, Firefox, etc.) and RunMRU activity to surface commands that would otherwise bypass straightforward detection. MITRE mappings include command interpretation and indirect execution via the Run dialog, aligning with techniques for user-driven command execution and browser-originated payloads.