All Detections

Clickfix detection

avatar
Enzo Bomfim@Enzima45
updated Nov 10, 2025532746

Thu rule focus in identity suspicious powershell commands execuded from the the windows "EXECUTE" box (WIN+R)

Microsoft Sentinel (KQL)