Banana RAT Executes Decrypted Code with ScriptBlock Create

Daniel Jeremiah@daniyyell

•updated Jun 20, 2026•0•0•9

Detects PowerShell invoking ScriptBlock::Create or Invoke-Expression on decrypted in-memory text, which is a technique used by malware like Banana RAT to execute obfuscated or dynamically generated code.