PowerShell AES-CBC decrypt with SHA256-gated ScriptBlock::Create execution

Ethan Andrews@eandrews

•updated Aug 24, 2026•14•0•12

Detects a PowerShell in-memory loader pattern that derives an AES key using Rfc2898DeriveBytes, decrypts an encrypted payload using System.Security.Cryptography.Aes, verifies the content with SHA256, and executes the decrypted code in-memory via [System.Management.Automation.ScriptBlock]::Create. This technique is often used to bypass file-based security controls by executing stage-two payloads directly in memory.