Time-Bound Unlock-File MOTW Removal Between Download and MSI Execution
Detects a PowerShell-driven sequence where a file is downloaded, has its Mark-of-the-Web removed via Unlock-File, then is executed through msiexec /i on the same file path within a 10-minute window, mirroring the SMOKE#SCREEN ScreenConnect delivery chain.
Cortex XDR
