Microsoft ClickFix - Network IOCs
This rule detects network connections to known malicious domains and IP addresses associated with the Microsoft ClickFix social engineering technique. It specifically looks for RemoteUrl matching a list of identified domains or RemoteIP matching a list of identified IP addresses within the last 30 days from device network events.
Microsoft Sentinel (KQL)
