Obfuscated PowerShell Alias and Wildcard Abuse

Elgonad .@elgonad

•updated Jan 27, 2026•3•1•96

Detects PowerShell commands that use aliases and wildcard matching to dynamically resolve sensitive cmdlets like Invoke-Expression or Invoke-RestMethod. This technique is used to evade static analysis and keyword-based detections and was observed in the Amatera Stealer infection chain.