PowerShell Cmdlet Globbing Detection

Luís Marques@remotecodeexecution

•updated today•0•0•1

Detects PowerShell commands using the call operator with 'Get-Command' (gcm) or 'Get-Alias' (gal) containing wildcards to resolve and execute sensitive cmdlets. This is a common technique to evade static string-based detections for commands like 'Invoke-Expression' or 'Invoke-WebRequest'.