PowerShell IEX Obfuscation Using MaximumDriveCount Variable

Tim P@bobbyTablez

•updated Jun 30, 2026•1•0•11

Detects an obfuscation technique where a threat actor hides Invoke-Expression (IEX) execution by using Get-Variable to parse out IEX characters from the MaximumDriveCount built-in variable and reconstruct them via -Join.