ROMULUS obfuscated PowerShell stager using $env:__ST and scriptblock Create

ills3c Intel&Coffee@Ills3C

•updated yesterday•1•0•3

Detects the execution of the ROMULUS staging script via PowerShell script block logging (Event ID 4104). The rule identifies specific indicators including the use of environment variable '__ST', '$MyInvocation.MyCommand.Path', dynamic code reconstruction via '[scriptblock]::Create', and a high comma count exceeding 200.