AsyncRAT - Obfuscated Cmdlet Reconstruction (T1027.002)

Ibrahim Saud@tektrix

•updated Jun 20, 2026•1•0•6

Detects PowerShell scripts that reconstruct native cmdlets (e.g., Test-Path) from fragmented character arrays mapped to Simplified Chinese variables, a technique observed in AsyncRAT campaigns for obfuscation.