Renamed PowerShell Execution (wt.exe)

Ethan Andrews@eandrews

•updated Apr 22, 2026•23•0•1,266

Detects the execution of PowerShell that has been renamed to 'wt.exe', matching the Axios RAT Windows payload behavior. This rule identifies processes masquerading as Windows Terminal (wt.exe) but whose underlying executable is actually PowerShell.