ClickFix CPaaS multi-layer obfuscated payload decode + API beacon
Detects instances where PowerShell scripts perform Base64-encoded operations related to cryptographic functions and shortly thereafter establish network connections to known or suspect domains associated with C2 activity.
Microsoft Sentinel (KQL)
