Operation Poisson: Havoc Demon In-Memory Load via Encoded PowerShell and CreateRemoteThread

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

This rule detects the execution of obfuscated PowerShell commands (encoded) that subsequently establish an external network connection and perform process injection within a short timeframe (120 seconds). This behavior is characteristic of malicious staged execution, where a PowerShell script acts as a dropper or loader to fetch secondary payloads and inject them into other processes for evasion.