When telemetry lies about execution
A PowerShell execution alert that looked like a false positive, and the reason the process tree said one thing while the command line said another.
Placeholder. Replace with the real write-up before publishing. Everything below is scaffolding that shows the expected shape.