PowerShell Case Anomaly Detection
Detects PowerShell command-line execution with unusual or randomized character casing for keywords like "powershell" or "-noprofile". This is a common obfuscation technique used by attackers to evade basic, case-sensitive detections. This rule is inspired by the THOR PowerShell_Case_Anomaly Yara rule.
Microsoft Sentinel (KQL)
