Suspicious PowerShell Archive Extraction (Steam_Monitor Campaign)

Brandon Rodriguez@BMRodriguez

•updated Mar 3, 2026•7•0•104

Detects the execution of PowerShell with a command line containing a specific sequence of strings associated with extracting and executing malware from a ZIP file, as observed in the Steam_Monitor campaign. This typically involves using PowerShell commands like 'Get-ChildItem', '::OpenRead', and 'TaR' in conjunction with a '.zip' file.