Rule Info
Name
PowerShell Dynamic Module Invocation Via ExportedCommands Array Index - PS Script
Author
Norbert Jaśniewicz (AlphaSOC)
Description
Detects obfuscated PowerShell scripts that enumerate Microsoft.PowerShell.Utility exported commands
and invoke cmdlets indirectly by array index. This can be used to evade detections
that look for explicit strings such as Invoke-RestMethod or Invoke-Expression.
Date
2026-10-06 00:00:00
Modified
None
Id
4ff4ad3e-9fb5-4a70-9962-d6ea58090318
Tags
attack.execution attack.stealth attack.t1027 attack.t1059.001
Type
Community Rule
Link to Public Repo
Rule History
Author
Title
Date
Commit
norbert791
Merge PR #6061 from @norbert791 - Add rules to detect PowerShell cmdlet obfuscation via ExportedCommands array index
2026-10-06
Scan your endpoints, forensic images or collected files with our portable scanner THOR