PowerShell Cache Smuggling via Headless Conhost
Detects PowerShell execution patterns associated with the "Cache Smuggling" technique. This involves copying browser cache files, searching them with regex for an embedded payload, and then writing and executing that payload. This specific variant was observed being launched by conhost.exe in headless mode to conceal the window.
Microsoft Sentinel (KQL)
