SocGholish PowerShell Reconnaissance With Obfuscation

Georg Lauenstein@gsec

•updated Dec 3, 2025•10•0•196

Detects PowerShell reconnaissance commands associated with SocGholish/RomCom activity, where PowerShell is invoked with embedded double quotes to evade simple detections.