How to Detect PowerShell Encoded Commands in Microsoft Sentinel (KQL)
A working SOC analyst's guide to detecting PowerShell -EncodedCommand abuse using KQL in Microsoft Sentinel. Production-ready detection rules with tuning notes.

http://socauthority.com/blog/how-to-detect-powershell-encoded-commands-sentinel-kql/


🎖https://t.me/ViperNull