PowerShell Obfuscation via Repeated Empty-String Literal Patterns

Marcus Mingo@meeengoh

•updated Feb 9, 2026•23•2•250

Detects PowerShell execution containing multiple repeated empty-string literal patterns such as "" or '' (including variants with whitespace), often used in trivial string-obfuscation techniques observed in malicious scripts. The regex is greedy so per environment tuning may be necessary.