MSHTA Fetching Polyglot Archive (InstallFix)
Detects the ClickFix technique where MSHTA is invoked to download and execute an MSIXBUNDLE that is actually a ZIP/HTA polyglot bypassing standard inspection. This rule specifically looks for mshta.exe executing with a command line that attempts to download files with extensions like .msixbundle, .zip, or .txt over HTTP/HTTPS, combined with network connection events.
Microsoft Sentinel (KQL)
