ClickFix PowerShell Download and Execution of oficioprotocolo.tng via IEX

Luís Marques@remotecodeexecution

•updated today•0•0•0

The rule attempts to detect the use of powershell to exec "officoprotocolo", which was part of the PhatomEnigma campaign