PowerShell sensor tampering followed by process hollowing on same device
Detects a sequence where PowerShell disables security or monitoring preferences (defense evasion / sensor blinding) followed closely by injecting code or performing process hollowing into a Windows process from the same PowerShell process.
Microsoft Sentinel (KQL)
