Dragon Weave - Profile.ps1 Script Chain Decryption

Ibrahim Saud@tektrix

•updated Jun 19, 2026•0•0•8

Detects PowerShell running Profile.ps1 decrypting the payload into RuntimeBroker_update.exe. This rule specifically looks for the execution of 'powershell.exe' with 'Profile.ps1' in its command line, followed by the creation of 'RuntimeBroker_update.exe' by that PowerShell process.