Hidden PowerShell bridge downloads and launches main.exe from WSL
Detects the execution of PowerShell with obfuscated parameters such as '-WindowStyle Hidden' and '-ExecutionPolicy Bypass' in combination with network-related cmdlets (Invoke-WebRequest) or process manipulation (Start-Process). It also checks for references to common temporary file paths or 'main.exe', often indicative of malicious script execution or payload staging. The rule also includes a filter to identify if the process was initiated by common WSL or Node.js related processes.
Microsoft Sentinel (KQL)
