Detection Deep Dive: Encoded PowerShell Commands (T1059.001)
The first entry in the Detection Deep Dive series: mapping encoded PowerShell execution to detection logic in Microsoft Defender, tuning out the false positives, and knowing what the detection can’t see.