CRPx0 ClickFix: Hidden PowerShell with -enc via Win+R Run Dialog
Detects suspicious PowerShell execution initiated by explorer.exe containing encoded commands, correlated with concurrent activity in the Windows RunMRU registry key or execution of rundll32.exe referencing 'WindowsUpdate.log'. This pattern is frequently used to mask malicious activity and maintain stealth during fileless execution or persistence operations.
Microsoft Sentinel (KQL)
