Suspicious Obfuscated Command-Line Execution
This detection identifies suspicious command-line obfuscation executed by common scripting engines such as PowerShell, CMD, and Windows Script Host. It detects high signal behaviors including string concatenation, repeated string reconstruction, character based assembly, and encoded command execution flags. These techniques are commonly used to conceal execution intent and evade security monitoring. Alerts should be reviewed in context to distinguish legitimate scripting from potentially evasive activity.
Microsoft Sentinel (KQL)
