ClickFix Variant - FortiClient Compliance Abuse via conhost + headless PowerShell
Detects conhost.exe launching a headless PowerShell one-liner that creates a FortiClient compliance directory, copies Chrome Cache data, reconstructs a ComplianceChecker.zip using unique markers, expands it and executes FortiClientComplianceChecker.exe — behavior observed in ClickFix-style social engineering campaigns.
Sigma
