PowerShell launched via piped stdin redirection to evade command-line logging

Emiliano Mema@Nosalva

•updated Jul 9, 2026•3•0•6

Detects the execution of PowerShell via stdin piping, which is a common technique used by attackers to execute scripts without specifying common command-line arguments like -Command or -File, potentially bypassing simple command-line monitoring or logging.