ClickFix fake CAPTCHA lures PowerShell via Run dialog
Detects suspicious PowerShell process execution initiated by Windows Explorer, specifically involving WebDAV-related commands or network share mounting indicators. This pattern is commonly associated with attackers attempting to download and execute remote payloads from WebDAV shares to bypass security controls.
Microsoft Sentinel (KQL)
