Net WebClient Casing Anomalies — Detection Rule

Detects PowerShell command line contents that include a suspicious abnormal casing in the Net.Webclient (e.g. nEt.WEbCliEnT) string as used in obfuscation techniques

Read the full analysis on IntelFusions