MSHTA Execution with Polymorphic Obfuscation (ClickFix)
Detects mshta.exe launching HTA files with randomized query strings that instruct the server-side to generate a unique payload hash, indicative of the ClickFix malware.
Microsoft Sentinel (KQL)
Detects mshta.exe launching HTA files with randomized query strings that instruct the server-side to generate a unique payload hash, indicative of the ClickFix malware.
Already have an account?