Suspicious RMM PowerShell Quick Deploy (TrustConnect/DocConnect)

Ethan Andrews@eandrews

•updated Feb 20, 2026•8•0•93

Detects PowerShell one-liners used by TrustConnect/DocConnect to download and execute secondary payloads. These commands are provided as a 'Quick Deploy' feature in the MaaS C2 panel and typically use Invoke-RestMethod (irm) piped to Invoke-Expression (iex) from known malicious domains.