ClickFix cache smuggling: wscript.exe running t.vbs copied from browser f_ cache
Detects the correlation of a file creation event in the user Temp folder (such as t.vbs) originating from browser cache or download patterns, followed shortly by the execution of the script via wscript.exe or cscript.exe.
Microsoft Sentinel (KQL)
