ClickFix: StealC ClickFix Persistence via WScript.Shell LNK in Startup Folder
Detects the creation or execution of script files (.lnk) within the Windows Startup folder initiated by script hosts (wscript.exe or cscript.exe) that contain suspicious command-line arguments indicative of malicious activity, such as PowerShell obfuscation or encoded commands.
Microsoft Sentinel (KQL)
