PowerShell building cleanup path array across AppData, Public, ProgramData, and Startup folders
Detects the execution of PowerShell or PWSH where the command line contains common environment variables and paths associated with the Windows Startup folder. This pattern is commonly used by adversaries to achieve persistence, ensuring malicious scripts execute upon user login.
Microsoft Sentinel (KQL)
