PowerShell AES-CBC Decrypt + GZipStream In-Memory .NET Loader

Ibrahim Saud@tektrix

•updated Sep 20, 2026•2•0•5

Detects the execution of PowerShell commands that utilize .NET cryptography classes (AesManaged) in conjunction with data compression (GZipStream) and base64 decoding (FromBase64String). This combination of classes is highly characteristic of malicious scripts designed to decrypt and execute obfuscated or packed payloads in memory.