T1082: Veil#Drop PureLog Stealer .NET Reconnaissance via PowerShell ScriptBlock

Tim Peck@timpeck

•updated Jul 1, 2026•11•0•40

Detects the PureLog Stealer performing system and process reconnaissance using .NET capabilities reflectively loaded via PowerShell. The rule monitors for the combination of process enumeration (System.Diagnostics.Process/Win32_Process), system metadata harvesting (Environment class properties), and memory-only execution patterns (Reflection.Assembly.Load) within PowerShell script block logs.