Detect JavaScript execution patterns commonly used to create blob phishing pages
Detects the presence of JavaScript obfuscation indicators such as 'atob(', 'Blob(', or 'URL.createObjectURL' in process command lines. These functions can be used by malicious scripts to decode or create objects from obfuscated data, often as part of a defense evasion strategy.
Microsoft Sentinel (KQL)
