Char-code obfuscated PowerShell PS1 dropped to Temp as persistence payload

Ibrahim Saud@tektrix

•updated Jun 24, 2026•1•0•6

This rule detects the execution of PowerShell scripts (.ps1) that were recently created in the AppData\Local\Temp directory. It specifically looks for PowerShell processes launched with parameters indicating a hidden window, no profile loading, and a bypass execution policy, which are common characteristics of malicious PowerShell activity.