Potential DeadVax Self-Parsing Script Execution

Aaron Beardslee@abeardslee

•updated Feb 4, 2026•1•0•36

Detects the execution of a PowerShell command characteristic of the DeadVax malware family. The threat actor uses a self-parsing batch script that invokes PowerShell to read its own content (`Get-Content`). It then uses a regular expression to find and extract a payload from a line starting with the '@' symbol. This technique is used to hide the next stage payload from static analysis.