Obfuscated Script Execution via PowerShell or VBScript

Mehulkumar Savajani@Msavajani

•updated Dec 20, 2025•49•1•376

Detects the execution of PowerShell or VBScript commands that contain indicators of base64 encoding. This is a common obfuscation technique used by malware like DarkGate to hide malicious payloads, often seen in social engineering campaigns like "ClickFix".