ClickFix clipboard paste followed by rapid encoded mshta/powershell execution
Detects the ClickFix pattern of a clipboard copy event followed within 5 seconds by an encoded/base64 mshta.exe or powershell.exe execution, consistent with DOUBLECUP's clipboard-hijacking lure.
Microsoft Sentinel (KQL)
