Kimsuky PowerShell String Reversal and Padding Obfuscation

Yolanda Icepa@yicepa

•updated Jul 17, 2025•3•2•30

Detects PowerShell commands using string reversal techniques and specific numeric padding, methods observed in Kimsuky's "ClickFix" campaigns to obfuscate malicious code. The rule looks for a combination of PowerShell string manipulation functions and a unique numeric string.