SynkLoader Obfuscated PowerShell Hex Char-Array Joined to IEX

Emiliano Mema@Nosalva

•updated Aug 28, 2026•0•0•1

Detects the execution of PowerShell with hidden window arguments that utilize a combination of hex-encoded character arrays, the -join operator, and Invoke-Expression (iex). This technique is commonly employed by attackers to execute obfuscated, memory-resident payloads while evading detection by security solutions.