InstallFix - CMD Variable Splitting Obfuscation (T1027)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•1•0•5

Detects delayed environment variable expansion (/v:on) used to dynamically split and reconstruct the powershell string to evade command line monitoring. This technique is often used by malware like InstallFix.