Usage of Inverted HTTP Protocol Handler - PowerShell

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects the use of inverted HTTP protocol handler in PowerShell commands or scripts. Threat actors may use inverted protocol handlers in the malware loaders/dropper to obfuscate their command, while trying to download second stage payloads or other malicious content, trying to bypass security controls that look for specific patterns in command lines.

2025-06-11 00:00:00

None

6e8c9fde-9c2f-45e6-a1d3-d89ffb9f4f38

attack.defense-evasion attack.t1027.010 attack.command-and-control attack.t1105

Nextron Sigma feed only (private)