Suspicious PowerShell IEX Invocation with String Concatenation

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects suspicious PowerShell command patterns using Invoke-Expression (IEX) with string concatenation to potentially obfuscate malicious downloads. Threat actors may use this technique to execute commands that download and run scripts from remote locations, often obfuscating the command to evade detection.

2025-06-04 00:00:00

None

5d9f2caf-03c2-42de-8c1e-1a59b22000f7

attack.execution attack.t1059.001 attack.defense-evasion attack.t1027.010

Nextron Sigma feed only (private)