CLICKFIX-TELEPUZ PowerShell Download from memshowblob.forum
Detects ClickFix social engineering used in the TELEPUZ/VIDAR campaign where a user is tricked into executing a PowerShell command that downloads a binary from memshowblob.forum using bypass flags and removes the Zone.Identifier ADS. Part of the CLICKFIX-VIDAR initial access chain delivering TELEPUZ MaaS malware.
Microsoft Sentinel (KQL)
