CrySome RAT C2 remote PowerShell execution via masquerading svchost.exe
Detects instances where PowerShell is executed with common bypass flags by a process masquerading as or spawned by 'svchost.exe' located in non-standard system directories, specifically targeting executions originating from user-writable temporary locations.
Microsoft Sentinel (KQL)
