PowerShell download from decimal-encoded IPv4 URL (ClickFix loader staging)
Detects PowerShell execution (powershell.exe or pwsh.exe) containing a URL with a decimal-encoded IPv4 host combined with common download cmdlets or .NET download methods, indicative of loader staging or ClickFix campaigns.
YARA-L
