KongTuke Malware - PowerShell DPAPI Payload Loader

Daniel Jeremiah@daniyyell

•updated Feb 14, 2026•2•0•31

This rule detects the execution of PowerShell with an execution policy bypass, specifically looking for a command line that includes 'AzureRemove-NetNatStaticMapping.ps1' and 'AppActions'. This combination is indicative of the KongTuke malware's second-stage loader, which uses a PowerShell script to load a DPAPI-unprotected payload.