PowerShell executed with parent or grandparent process of mshta.exe (Clickfix)
This hunt looks for PowerShell being executed as a child or grandchild of mshta.exe or network events initiated by PowerShell as a child of mshta.exe. There are two ways to approach this: Look for device network events initiated by PowerShell with a parent of mshta.exe Look for process events where PowerShell is executed with a parent process of mshta.exe The search in this hunt leverages the second approach. You could also look for PowerShell command lines making web requests but the obfuscation employed by known threat actors makes this more difficult to find by matching strings.
Microsoft Sentinel (KQL)
