AutoJack MCP WebSocket Encoded PowerShell Execution via autogenstudio

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•2

This rule detects PowerShell or pwsh processes executing commands that contain the string 'autogenstudio' combined with a base64-encoded or obfuscated command pattern. This behavior is indicative of an adversary attempting to execute obfuscated scripts or payloads associated with the Autogenstudio application or using it as a camouflage.