DeadVax Self-Parsing Script Payload Extraction

Annie N@annie

•updated Mar 10, 2026•1•37

Detects a PowerShell script attempting to read the content of a command or batch file (.cmd) to extract a payload. This technique was observed in the DeadVax campaign where a batch script invokes PowerShell to parse its own content, looking for a line starting with '@' which contains the next stage's Base64-encoded payload.