Clickfix Explorer Spawns Headless Conhost Attack Chain
Detects a process execution chain characteristic of the ClickFix technique, where explorer.exe spawns a headless conhost.exe, which in turn leads to the execution of curl.exe to download a payload.
YARA-L
