Cobalt Strike PowerShell Loader Functions and Methods

Aaron Mog@AaronMogS2S

•updated Jun 19, 2025•5•5•83

Detects PowerShell script blocks containing function definitions or .NET method calls commonly used by Cobalt Strike PowerShell loaders for dynamic API resolution, memory allocation, and shellcode execution. This rule is based on analysis from the provided reference.