Nested PowerShell Loader Execution via cmd.exe

Ethan Andrews@eandrews

•updated Jun 8, 2026•3•0•9

Detects the execution of nested, hidden, and bypassed PowerShell sessions spawned by cmd.exe, typically launched from a Startup LNK file. This behavior is associated with the SHADOW-EARTH-066 campaign, which uses specific command-line arguments for evasion and loads payloads from C:\ProgramData\ using Invoke-Expression or iex.