Invoke-PowerShellTcp Reverse Shell Execution via IEX After AMSI Bypass

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•8

Detects the execution of Nishang's Invoke-PowerShellTcp reverse shell script via PowerShell, typically executed via IEX (Invoke-Expression) to load the payload directly into memory, which is a common post-exploitation technique often performed following an AMSI bypass.