Identify shebang files via Threat Hunting (+ KQL Queries)

This post defines shebang (#!) scripts used on Unix-like systems and provides practical Kusto Query Language (KQL) examples to hunt for shebang files in Microsoft Defender telemetry—covering detection of attachments, files in suspicious directories, and scripts disguised with benign extensions—while recommending whitelisting to reduce false positives.