Dead#Vax Self-Parsing Script Execution

Detects a specific script execution pattern where a batch file, often named 'rEgX.cmd', is read by a PowerShell process (or a renamed variant like 'mbs.exe') to extract a hidden, encrypted payload from its own content. This self-parsing technique, used by the Dead#Vax malware, looks for lines starting with a specific marker (e.g., '@') to bypass traditional file-based detection.