PowerShell-launched random-named temp executable with long encoded argument

ills3c Intel&Coffee@Ills3C

•updated yesterday•1•0•3

Detects PowerShell execution of an executable from the Temp directory with a randomly generated name and long base64-like encoded arguments, characteristic of Metro4Shell activity.