Operation Poisson: PowerShell In-Memory Shellcode/Reflective Loader Execution

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects the execution of PowerShell (powershell.exe or pwsh.exe) containing command line arguments indicative of malicious activity, including encoded commands, memory loading, assembly loading, thread creation, or attempts to bypass AMSI (Antimalware Scan Interface). The rule specifically excludes processes signed by Microsoft to reduce false positives.