GetCurrent User with PowerShell Script Block

The analytic detects the execution of the `GetCurrent` method from the WindowsIdentity .NET class using PowerShell Script Block Logging (EventCode=4104). This method identifies the current Windows user. Adversaries and Red Teams may use this for situational awareness and Active Directory discovery on compromised endpoints to map user accounts, potentially leading to privilege escalation or lateral movement.