Detect Powershell Obfuscation

Daniel Jeremiah@daniyyell

•updated Jun 19, 2026•1•0•4

Detects obfuscated PowerShell commands commonly used in malicious scripts by looking for encoded PowerShell execution and specific obfuscated cmdlet patterns like 'new-item', 'net.webclient', 'downloadfile', and 'invoke-item'.