Obfuscated PowerShell String Concatenation with Reused Quote Delimiter

Marcus Mingo@meeengoh

•updated Dec 1, 2025•5•1•83

Detects PowerShell command lines that use repeated, obfuscated string concatenation patterns such as "<str>"+"<str>" "<str>"+"<str>" (or the same with single quotes), which often appear in lightly obfuscated malware or LOLBins. Often seen in dropper activity related to Clickfix.