Agent Tool Downloads File and Immediately Executes It (T1105)
Detects scenarios where common download utilities are used to fetch a file from the internet, followed by the immediate execution or loading of that same file within a 10-minute window, indicative of an Ingress Tool Transfer followed by execution.
Microsoft Sentinel (KQL)
