ScreenConnect dropped via fake "diagnostic tool" batch file (COLDCARD phishing)
Detects the use of the Certutil utility to decode an encoded file (often obfuscated malicious code) followed by the execution of an MSI installer on the same device. This pattern is commonly used in multi-stage downloaders and installer-based attacks to reassemble or deobfuscate payload files.
Microsoft Sentinel (KQL)
