ClickFix / CrashFix Python RAT Activity
This rule detects suspicious activities associated with the ClickFix / CrashFix Python RAT. It identifies three main patterns: the execution of 'finger.exe' as a potential fetch mechanism, PowerShell execution with encoded commands originating from web browsers or common system utilities, and Python script execution from suspicious temporary or download directories, indicative of RATs like ModeloRAT or CastleRAT.
Microsoft Sentinel (KQL)
