Operation Poisson: PowerShell In-Memory Havoc/Demon C2 Delivery

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects execution of PowerShell commands using suspicious combinations of flags, obfuscation techniques, or indicators often associated with fileless malware delivery, such as Base64 encoded commands, hidden window execution, and memory-resident loading (e.g., Invoke-Expression, IEX, VirtualAlloc). The rule scores based on the combination of indicators, flagging highly suspicious patterns.