Potential PowerShell IEX Obfuscation Using GCM or GAL Analytic

Tim P@bobbyTablez

•updated Jun 30, 2026•3•0•4

Detects an obfuscation technique where a threat actor hides Invoke-Expression (IEX) of a malicious script behind the Get-Alias or Get-Command cmdlet shortcuts (gal/gcm).