Suspicious PowerShell Execution with Renamed Binary
This rule detects potential obfuscated or stealthy PowerShell execution by identifying PowerShell commands that do not use the default 'powershell' or 'pwsh' executable names but still contain common PowerShell command-line arguments such as '-NoProfile', '-ExecutionPolicy', or 'Invoke-Expression'. It correlates these executions with user logon sessions to aid in attribution and threat hunting.
Microsoft Sentinel (KQL)
