Clickfix - Windows shell tampering and browser hijacking
The detection targets these behaviours: - Attempts to take ownership of or replace explorer.exe and gpedit.msc. - Changes to Microsoft Edge's Image File Execution Options (IFEO) debugger. - Changes to HTTP, HTTPS, HTML, and Microsoft Edge protocol handlers. - Disabling Explorer's Run command and changing keyboard scancode mappings. - Creation of temporary VBScript files used for relaunching, elevation prompts, or deceptive messages
Microsoft Sentinel (KQL)
