PowerShell MSI download from Azure Blob followed by msiexec spawning PowerShell

ills3c Intel&Coffee@Ills3C

•updated 2 days ago•1•0•5

Detects a sequence where PowerShell downloads an .msi file from Azure Blob storage (blob.core.windows.net), followed by msiexec.exe spawning PowerShell on the same device within 30 minutes.