Script Self-Parsing Payload Extraction

Travis Newshott@tn_ggl

•updated Mar 10, 2026•1•0•50

Detects instances where PowerShell is used to read the contents of a batch file (specifically looking for '.cmd' or '.bat' extensions) to extract a payload. This logic focuses on the 'Get-Content' cmdlet being applied to a script file, which is a key component of the campaign's self-parsing and payload extraction mechanism, as seen in the Dead#Vax campaign.