ClickFix cache smuggling: wscript running VBScript that enumerates f_ browser ca
Detects script execution (such as wscript, cscript, mshta) spawned from a shell parent process (like explorer.exe or cmd.exe) referencing browser cache files (matching f_* in browser profile directories) or copying scripts to the local Temp directory as t.vbs.
Microsoft Sentinel (KQL)
