ClickFix Series: Fileless PowerShell via conhost.exe With Missing Command-Line T
Detects the execution of PowerShell or PowerShell ISE where the parent process is the console host (conhost.exe) and the command-line arguments are either missing, empty, or represent an bare execution of the binary. This pattern is commonly associated with fileless execution techniques where attackers attempt to hide command-line arguments or evade logging.
Sigma
