Microsoft ClickFix - PowerShell to WScript Execution
This rule detects a specific social engineering technique, dubbed 'ClickFix', where PowerShell is used to launch WScript or CScript. The detection specifically looks for PowerShell being initiated by explorer.exe, indicating a user interaction (e.g., clicking a malicious file or link), and then launching WScript.exe or cscript.exe. The PowerShell command line is expected to contain '-windowstyle minimized -Command' and 'Invoke-WebRequest', suggesting an attempt to download and execute a script in a hidden window.
Microsoft Sentinel (KQL)
