LunarApplication PowerShell Execution with Obfuscated Script
Detects a specific obfuscated PowerShell command-line pattern used by the LunarApplication malware to execute scripts from the %TEMP% directory while bypassing execution policies. This rule looks for PowerShell processes with specific flags to bypass execution policy and accept piped input, combined with distinctive randomized script extensions (.yiz.ps1 or .unx.ps1) typically used by this malware.
Microsoft Sentinel (KQL)
