FrostyNeighbor JS Update Flag Execution
Detects the execution of wscript.exe or cscript.exe with the '--update' command-line flag, a technique used by the FrostyNeighbor JavaScript dropper to transition to its second execution phase (PicassoLoader).
Microsoft Sentinel (KQL)
