ClickFix: explorer-spawned PowerShell downloads MSI then runs msiexec/putty
Detects the Exvicy 'ClickFix' campaign execution chain where explorer.exe spawns a PowerShell process utilizing download commands (e.g., Invoke-WebRequest, Invoke-RestMethod) to interact with known malicious domains or IP addresses, followed by the execution of installers (msiexec.exe) or tools (putty.exe) within a short timeframe.
Microsoft Sentinel (KQL)
