ClickFix TerminalFix: Windows Terminal spawning PowerShell that starts a downloa
Detects Windows Terminal or related console hosts spawning PowerShell or PowerShell Core with command-line arguments indicative of staging, downloading, or executing remote scripts (such as encoded commands, Invoke-Expression, or web requests), commonly associated with ClickFix or social engineering techniques.
Splunk (SPL)
