ULTIMATE ClickFix Multi-Stage Attack Chain Correlation
Correlates multiple suspicious behavioral patterns characteristic of the 'ClickFix' attack chain. The rule detects techniques such as PowerShell execution via RunMRU or Windows Terminal, CAPTCHA-lure download cradles, hidden-window PowerShell execution, fileless AES/TripleDES runspace payloads, COM hijacking, and suspicious LOLBin usage. The detection logic uses a 1-hour sliding window to aggregate these patterns on a per-device basis, assigning a higher confidence score as more stages of the attack chain are observed.
Microsoft Sentinel (KQL)
