UNC5142 In-Memory PowerShell Payload Execution

nomit vyas@xoxo

•updated Jun 23, 2026•0•0•4

Detects PowerShell scripts that contain decryption routines and in-memory execution commands, a technique used by UNC5142 to run final payloads while evading disk-based detection.