TELEPUZ ClickFix PowerShell VIDAR Stager Download from memshowblob.forum
This rule detects PowerShell commands initiated by web browsers that exhibit characteristics of the 'ClickFix' social engineering technique. The detection logic looks for high-risk flags (hidden window, bypass execution policy) associated with common ClickFix artifacts such as references to temporary directories, domain-specific indicators like 'memshowblob.forum', and the removal of Zone.Identifier alternate data streams which are often used to bypass security warnings.
Microsoft Sentinel (KQL)
