Suspicious PowerShell String Normalization

Tim Peck@timpeck

•updated Jan 13, 2026•5•0•116

Detects PowerShell commands that utilize string normalization obfuscation techniques before Base64 decoding. This rule identifies a generic pattern where one or two placeholder characters are replaced with a literal character, a technique used by malware like SHADOW#REACTOR to bypass static string analysis of the encoded payload.