PSNATCH PowerShell Recursive File Stealer Scanning User Directories

Ibrahim Saud@tektrix

•updated Sep 20, 2026•0•0•4

Detects the execution of PowerShell commands that enumerate files within sensitive user directories such as Desktop, Downloads, Documents, or OneDrive, using common cmdlets like Get-ChildItem with recurrence or filtering. This behavior is indicative of an adversary attempting to discover or stage files for exfiltration.