suspicious-powershell-hunt-cross-platform-ideas

Hypothesis-driven hunt plan for suspicious PowerShell, plus query snippets for common telemetry.