Threat Hunt: ClickFix | FileFix - Explorer | Browser Spawning Suspicious Process
Detects potential FileFix attacks where a web browser spawns a suspicious child process (e.g., command prompt, PowerShell, MSHTA) via the file upload dialog's address bar. Enhancement: This query correlates two queries to find cases where a user accessed RunMRU and then executed a suspicious PowerShell command. RMU flags are added to get more close records mapped with Registry Access to RunMRU (Clipboard Paste via Run Dialog) Copy Clipboard data.
Microsoft Sentinel (KQL)
