Possible ClickFix Encoded Payload Fetch
This rule detects HTTP traffic that may indicate a ClickFix social engineering attack. Specifically, it looks for HTTP responses with a 'Content-Type' of 'text/plain' and content within the HTTP header that matches patterns associated with PowerShell, encoded commands, or 'iex' (Invoke-Expression), suggesting the delivery of an encoded PowerShell payload.
Microsoft Sentinel (KQL)
