Gamaredon Obfuscated PowerShell with EncodedCommand or IEX

Ibrahim Saud@tektrix

•updated Jun 26, 2026•0•0•3

Detects the execution of PowerShell with encoded commands initiated by common office applications (e.g., WinWord, Excel) or scripting engines (e.g., wscript, mshta). The rule specifically targets command lines longer than 200 characters that are not digitally signed by Microsoft, often indicating obfuscated malicious payloads intended to evade detection.