AI branded installer spawning script host
This rule spots fake AI installers that immediately launch hidden scripts on a Windows computer. Attackers dress up malware as popular AI tools so victims click without thinking. The alert means a suspicious install may be trying to run commands in the background. If this was not expected, treat it as a possible scam or break-in.
Microsoft Sentinel (KQL)
