CrySome RAT C2-Issued Hidden PowerShell EncodedCommand Execution

Duo Tech@duotech

•updated Jul 9, 2026•1•0•7

Detects the execution of PowerShell with a combination of flags commonly used to bypass security policies, obscure command execution, and run hidden tasks: -NoProfile, -ExecutionPolicy Bypass, and -EncodedCommand.