Windows Script Host Registry Repair (AsyncRAT)
This rule detects attempts by PowerShell to modify the Windows Registry to re-enable Windows Script Host. This behavior has been observed with AsyncRAT, which may attempt to repair the script environment if it was disabled by defenders.
Microsoft Sentinel (KQL)
