Ingress tool transfer via certutil or Invoke-WebRequest followed by execution
Detects certutil.exe -urlcache usage or PowerShell Invoke-WebRequest retrieving main.exe/cryptor.exe or similarly named payloads, followed by execution of the downloaded file, excluding downloads from an allowlist of approved internal software-distribution domains.
Microsoft Sentinel (KQL)
