Banana RAT Launches Hidden PowerShell from a Batch File
Detects `cmd.exe` starting PowerShell with hidden-window, bypass execution policy, and encoded-content options, which is a common technique used by malware like Banana RAT to evade detection and execute malicious scripts. The rule specifically looks for PowerShell or pwsh.exe being launched with command-line arguments indicating hidden windows, execution policy bypass, or encoded commands, with `cmd.exe` as the parent process.
CQL
