AdFection: Browser Contacts Watchlist Domain Then Spawns Script Host or Drops Ex
Detects instances where a web browser accesses a domain listed in the 'AdFection_Domains' watchlist, followed closely by the browser spawning a script interpreter (such as PowerShell, wscript, cscript, mshta) or dropping an executable/script file in user profile or temporary directories.
Microsoft Sentinel (KQL)
