Suspicious PowerShell/MSHTA Execution from Office/Explorer
Detects suspicious execution of PowerShell or MSHTA with encoded commands or web content from common user-facing applications like Explorer, Word, or Outlook. This pattern is often indicative of initial access or execution techniques used by adversaries.
Microsoft Sentinel (KQL)
