Windows - PowerShell - Possible ClickFix
This rule detects suspicious PowerShell activity that involves hidden windows, execution policy bypass, and attempts to download or execute files. It specifically looks for PowerShell processes launched by common parent processes like explorer.exe, cmd.exe, mshta.exe, wscript.exe, cscript.exe, or rundll32.exe, combined with command-line arguments indicative of stealthy execution and payload delivery. The rule identifies two main scenarios: 'Hidden Downloader and Execution' where PowerShell is used with hidden window styles and download commands, and 'Inline Launcher and Payload Delivery' where PowerShell is used with no profile and download/execution commands.
Microsoft Sentinel (KQL)
