examples:

• description: "Execute gc_worker.exe and observe the unusual behavior" command: "gc_worker.exe"

gc_worker.exe

Base64-encoded PowerShell from Azure's own agent!

The Azure Connected Machine Agent spawns a process that runs encoded Powershell strings. Triggers when the agent downloads new policies from Azure.

Contributed by rcegan