WMI Spawning PowerShell via JScript
Detects a Windows Script Host process (wscript.exe or cscript.exe) using WMI to spawn a PowerShell process. This technique is used by malware, such as in the Remcos RAT delivery chain, to break the parent-child process relationship and evade detections based on process ancestry.
Microsoft Sentinel (KQL)
