drop 4688 evtx csv · powershell wscript cscript mshta abuse · decode encoded commands · export csv · runs locally
powershell · wscript · cscript · mshta · cmd obfuscation patterns
drop 4688 evtx csv export(s)