GammaSteel FileSystemWatcher Spying via PowerShell

Ethan Andrews@eandrews

•updated Jun 4, 2026•4•0•10

Detects the initiation of a FileSystemWatcher object in PowerShell configured to monitor the 'Changed' event. This technique is used by GammaSteel for real-time document surveillance to steal files the moment they are modified.