SloppyRAT PSSpoof: powershell.exe with Spoofed explorer.exe Parent

Ibrahim Saud@tektrix

•updated Sep 19, 2026•0•0•2

Detects the execution of PowerShell with suspicious command-line arguments (e.g., encoded commands, hidden window, download strings, or invocation commands) initiated by Windows Explorer. This is a common pattern for malicious scripts or droppers attempting to execute code covertly.