APT28 ClickFix - Browser Spawning Command Interpreter or Scripting Host
Detects instances where common web browsers initiate secondary processes such as command-line interpreters (cmd.exe, powershell.exe) or scripting engines (wscript.exe, cscript.exe, mshta.exe). This pattern is frequently indicative of drive-by download attacks or initial access where an adversary uses web browser activity to execute malicious scripts or commands.
Microsoft Sentinel (KQL)
