GreatXML Embedded Scriptblock Extraction
Detects PowerShell commands extracting and executing script blocks embedded in XML files (e.g., unattend.xml). This behavior is observed in the GreatXML BitLocker bypass exploit, where an attacker leverages a crafted unattend.xml during Windows Defender Offline Scan to spawn an unrestricted shell.
Microsoft Sentinel (KQL)
