Qilin Obfuscated Powershell Evasion
Detects obfuscated PowerShell commands used to disable security features, such as AMSI bypass, disabling TLS certificate validation, and enabling Restricted Admin mode. This behavior is a known TTP of the Qilin ransomware group.
YARA-L
