In-Memory AES Decryption Routine (T1140)

Ibrahim Saud@tektrix

•updated Jun 22, 2026•0•0•2

Hunts for PowerShell scripts natively importing cryptographic classes (AesManaged, CryptoStream) to decrypt secondary payloads directly in memory.