TONResolver BigInteger PowerShell Stage-1 Dropper Writing PS1 to TEMP

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects suspicious PowerShell command-line activity commonly associated with malicious scripts, including execution bypass (e.g., -ep bypass), the use of .NET BigInteger for potential obfuscation, and downloading files via Invoke-WebRequest to the temp directory. The rule further increases fidelity by identifying if the parent process is a common execution vector such as explorer.exe, wscript.exe, or mshta.exe.