ClickFix PowerShell Clipboard Access via Explorer
Detects the execution of PowerShell commands initiated directly from explorer.exe that contain indicators of the 'ClickFix' attack vector, specifically commands designed to extract data from the clipboard (e.g., Get-Clipboard) or download/execute remote content (e.g., iwr, iex). This activity typically occurs when a user is socially engineered into copying and pasting malicious instructions into the Windows Run dialog.
Microsoft Sentinel (KQL)
