All Detections

System Script Used as Proxy for Execution

avatar
Darshan Thummar@Mighty
updated Jun 13, 2026002

Detects system scripts like PubPrn used as execution proxies for defense evasion

Microsoft Sentinel (KQL)