Suspicious Explorer Process with Whitespace Padding - ClickFix/FileFix (via process_creation)

This rule detects process creation with anomalous whitespace padding followed by a '#' character, which may indicate ClickFix or FileFix methods used to conceal hostile commands from visual inspection. ClickFix and FileFix are social engineering attack methods where threat actors distribute phishing documents or hostile links that deceive users into opening the Windows Run dialog box or File Explorer search bar. The victims are then instructed to paste commands from their clipboard, which contain extensive whitespace padding using various Unicode space characters to push the actual hostile command far to the right, effectively hiding it from immediate view.