MIMICRAT ClickFix Obfuscated PowerShell Command
Detects the execution of a PowerShell one-liner with obfuscation techniques characteristic of the MIMICRAT ClickFix campaign. This campaign tricks users into pasting a command that uses string manipulation and arithmetic to reconstruct and execute a malicious payload.
Microsoft Sentinel (KQL)
