Rule Info
Name
PowerShell Dynamic Module Invocation Via ExportedCommands Array Index
Author
Norbert Jaśniewicz (AlphaSOC), Swachchhanda Shrawan Poudel (Nextron Systems)
Description
Detects PowerShell processes invoked with obfuscated command lines that enumerate Microsoft.PowerShell.Utility
exported commands and invoke cmdlets indirectly by array index. This technique is used to evade
detections that look for explicit strings such as Invoke-RestMethod or Invoke-Expression.
Date
2026-10-06 00:00:00
Modified
None
Id
0c3ebe9f-df09-4e00-be0f-73d4ca8d62f6
Tags
attack.execution attack.stealth attack.t1027.010 attack.t1059.001
Type
Community Rule
Link to Public Repo
Rule History
Author
Title
Date
Commit
norbert791
Merge PR #6061 from @norbert791 - Add rules to detect PowerShell cmdlet obfuscation via ExportedCommands array index
2026-10-06
Scan your endpoints, forensic images or collected files with our portable scanner THOR