Armorsteal PowerShell one-liner from typosquatted Chocolatey/Massgrave lure
Detects a PowerShell download-and-execute command referencing specific typosquatted lure domains (e.g., choclatey.org, massgravel.net) combined with follow-up script activity writing into a fake SystemHealth\Update directory.
Microsoft Sentinel (KQL)
