Suspicious Command Line Leading To File Downloads
This detection looks at users attempting to download files from the internet using powershell / cmd commands. It measures the number of commands against a baseline set over the past 14days and if a user has performed an unusual amount of commands (also more than 5) then an alert will be created. This will detect when an attacker has compromised a user and is now attempting to download payloads from the internet or a C2.
Microsoft Sentinel (KQL)
