ClickFix 1.bat persistence and CertEnrollCtrl sideload from ProgramData
Detects potential DLL sideloading of CertEnroll.dll via CertEnrollCtrl.exe spawned from non-standard paths (such as ProgramData, AppData, or Temp) and associated persistence mechanisms using batch files to create scheduled tasks or registry run keys.
Microsoft Sentinel (KQL)
