Batch Script Self-Parsing To Extract Payload

Detects the execution of a PowerShell command intended to read the content of the batch script that launched it. This technique is often used as a form of steganography to hide and extract an embedded payload from the script file itself. Attackers, such as in the Dead#Vax campaign, use this method to deobfuscate and load the next stage of an attack in memory.