StopAndProtect PowerShell stage1→stage2 reflective .NET load (vcapcha.ps1)
Detects the StopAndProtect two-stage PowerShell chain: stage 1 downloads/executes stage 2, which reflectively loads a base64-encoded .NET assembly and invokes an Execute method.
Microsoft Sentinel (KQL)
