Obfuscated PowerShell Execution via CMD Variable Splitting

Ethan Andrews@eandrews

•updated May 6, 2026•16•0•1,120

Detects the variable splitting technique in cmd.exe specifically designed to obfuscate the invocation of PowerShell (e.g., set x=pow&&set y=ershell). This technique is used in the InstallFix campaign to bypass static command-line monitoring.