PowerShell SSL Certificate Validation Disabled

Duo Tech@duotech

•updated Jun 4, 2026•1•0•18

Detects PowerShell script block contents indicating the manual bypassing of SSL certificate validation. This defense evasion technique is notably used by the Gamaredon GammaLoad third stage (which executes via an encoded command) to ensure successful connection to potentially untrusted or self-signed C2 infrastructure.