PowerShell AES-CBC Decrypted Payload Executed via ScriptBlock::Create

Emiliano Mema@Nosalva

•updated Aug 28, 2026•0•0•3

Detects the use of PowerShell commands that leverage .NET AES cryptography with CBC mode to decrypt payloads in-memory, subsequently executing the resulting code directly via [System.Management.Automation.ScriptBlock]::Create. This technique is often used to bypass disk-based signature detection.