LLM-generated PowerShell script placeholder artifacts detected via 4104
Detects the execution of known offensive PowerShell scripts used for Active Directory information gathering, as identified by specific file names or internal script block strings.
Microsoft Sentinel (KQL)
