Argamal RAT Delphi Loader Spawning Encoded PowerShell Stager

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•2

Detects the execution of PowerShell with encoded commands originating from suspicious process paths (outside Windows or Program Files directories). The rule includes logic to identify potential sandbox evasion by correlating the PowerShell activity with subsequent tasklist.exe execution within a short window, often characteristic of malware performing environment checks.