PowerShell Masquerading as Windows Terminal

Danny Y@zendannyy

•updated Apr 3, 2026•33•3•1,261

Detects PowerShell executable being copied to the ProgramData directory and renamed to 'wt.exe' (Windows Terminal) to masquerade as a legitimate binary. This is a documented defense evasion technique used by the Windows dropper for the Axios npm supply chain attack.