PowerShell IWR to EmEditor Lookalike Domains

Daniel Jeremiah@daniyyell

•updated Feb 28, 2026•0•25

This rule detects PowerShell or pwsh.exe processes executing commands that contain specific lookalike domains and paths associated with a watering-hole attack targeting EmEditor users. The rule looks for command lines containing 'emeditorjp.com', 'emeditorgb.com/run/mg8heP0r', 'emeditorde.com/gate/start/2daef8cd', or 'cachingdrive.com/gate/init/2daef8cd'. This activity indicates a potential compromise where a modified installer or malicious script is attempting to fetch additional hidden code from these domains.