User Discovery With Environment Variables in PowerShell

The analytic detects the execution of `powershell.exe` with command-line arguments that use PowerShell environment variables to identify the current logged user. This activity is significant as adversaries may use it for situational awareness and Active Directory discovery on compromised endpoints. If confirmed malicious, this behavior could allow attackers to gather critical user information, aiding in further exploitation and lateral movement within the network.