COLDRIVER MAYBEROBOT Obfuscated PowerShell for Persistence

Kaung Khant Ko@kaungkhantko

•updated Oct 21, 2025•2•2•291

Detects the execution of heavily obfuscated PowerShell, characteristic of the MAYBEROBOT backdoor. COLDRIVER uses this script, often via a logon script for persistence, to download and execute further commands. The rule specifically looks for a combination of string replacement functions ('-replace', '\n', ';', '[^\x20-\x7E]') used by MAYBEROBOT for de-obfuscation before execution.