ChainScript PowerShell task: temp script execution with bypass flags

Kaung Khant Ko@kaungkhantko

•updated Sep 21, 2026•1•0•9

This rule detects suspicious PowerShell execution initiated by a Node.js process (node.exe). It monitors for command lines containing common bypass flags (-NoProfile, -NonInteractive, -ExecutionPolicy Bypass) and a specific string pattern 'wra-ps-', which is often associated with malicious scripts or remote access trojans (RATs) being executed via a Node.js application.