Suspicious PowerShell In-Memory C# Compilation

Tim Peck@timpeck

•updated Feb 2, 2026•4•0•109

Detects the use of the 'Add-Type' cmdlet in PowerShell to compile and load C# code directly into memory. This technique is used by the TAMECAT backdoor to pivot from PowerShell to C# modules for tasks like exfiltration and browser data theft, bypassing file-on-disk scanning.