PowerShell ASCII char-code reconstruction and obfuscated EncodedCommand execution
Detects suspicious PowerShell execution patterns involving dynamic command reconstruction using [char[]] character arrays and the iex (Invoke-Expression) cmdlet, or the use of specific base64 EncodedCommand prefixes associated with known obfuscation tools like Banana RAT.
Microsoft Sentinel (KQL)
