ClickFix Run-Dialog Execution with Encoded/Obfuscated Command Line
Detects ClickFix-style initial access where a Run-dialog-spawned interpreter (cmd.exe, powershell.exe, mshta.exe, cscript.exe) executes an encoded or obfuscated command line, consistent with clipboard-paste delivery of C2Looper.
Microsoft Sentinel (KQL)
