Teams process spawning ClickFix-style PowerShell or run-dialog execution

ills3c Intel&Coffee@Ills3C

•updated yesterday•2•0•8

Detects instances where Microsoft Teams (ms-teams.exe, Teams.exe) or its associated WebView2 process spawns a command or script interpreter (such as PowerShell, Cmd, Mshta, Wscript, Cscript) with suspicious download-and-execute arguments, which is commonly associated with ClickFix social engineering attacks or similar initial access tactics.