ClickFix - Browser Cache Script Staging and Execution
The KQL rule detects a ClickFix-style technique in which script hosts reference files disguised with an f_* naming pattern in browser profile cache directories. The key behavioural indicators are: - Script hosts such as wscript.exe, cscript.exe, and mshta.exe referencing browser cache paths. - Suspicious parent processes, including Explorer, command shells, and script hosts. - Creation, modification, or renaming of t.vbs under the user's Temp directory by Windows Script Host.
Cortex XDR
