PowerShell MSI download from Azure Blob followed by msiexec-launched PowerShell
Detects a sequence where PowerShell downloads an .msi installer file from Azure Blob Storage, followed closely by msiexec.exe spawning a PowerShell process on the same device.
Microsoft Sentinel (KQL)
