PowerShell Reflective PE Loading for Agent Tesla

Ethan Andrews@eandrews

•updated Feb 25, 2026•2•0•33

This rule detects PowerShell execution containing keywords related to AES decryption combined with a Base64 encoded MZ header ('TVqQAAM'). This pattern is indicative of reflective loading of malicious assemblies in memory, a technique used by malware like Agent Tesla to bypass disk-based defenses.