ClickFix-Style use of PowerShell to Potentially Install Malware
This KQL/MDE query looks for the user of PowerShell initiated from explorer that could indicate Win+R or Win+X initiation. It will extract a URL from the command and display it if present
Microsoft Sentinel (KQL)
