cmd.exe spawns powershell.exe from Downloads/Temp after phishing .bat execution
Detects the execution of PowerShell (powershell.exe) spawned by the Windows Command Shell (cmd.exe) where the command originated from user-writable directories such as Downloads, Temp, or AppData\Local\Temp. This pattern is commonly associated with the execution of downloaded payloads or malicious scripts.
Microsoft Sentinel (KQL)
