PowerShell Execution via env:INTERNAL_DB_CACHE

Ethan Andrews@eandrews

•updated Jun 9, 2026•3•0•13

Identifies PowerShell executing a script block directly from the specific environment variable 'INTERNAL_DB_CACHE', as observed in the Evil MSI Background steganography campaign. This technique is used to hide malicious PowerShell code within an environment variable and execute it, bypassing direct script file detection.