ClickFix clipboard-paste execution via cmd findstr ZZ1984 marker
Detects ClickFix social-engineering attacks where a user is tricked into pasting malicious commands into the Windows Run dialog. The detection monitors explorer.exe spawning cmd.exe or powershell.exe with specific command-line indicators, such as wildcard patterns used to obfuscate powershell.exe names, the 'ZZ1984' marker string associated with DOUBLECUP/ClickFix loaders, or specific loop structures ('for /f') designed to locate and parse payloads staged in browser cache.
Microsoft Sentinel (KQL)
