Invoke-PowerShellTcp Reverse Shell Execution After AMSI Bypass

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•0

Detects the execution of Nishang's Invoke-PowerShellTcp reverse shell payload. This rule monitors for PowerShell processes (powershell.exe or pwsh.exe) that execute suspicious command-line strings associated with the payload, or common obfuscation/execution patterns like iex/Invoke-Expression, accompanied by an outbound network connection to a non-standard port and non-internal IP address.