HTA/VBScript-spawned PowerShell WebClient download to %TEMP%\runexe.bat
Detects malicious downloader activity where mshta.exe or a spawned runexe.bat script utilizes PowerShell's Net.WebClient to download and execute secondary payloads. This is a common pattern for stage-two malware delivery.
Microsoft Sentinel (KQL)
