ExecutionContext Reflection Abuse

X__Junior

Detects attempts to abuse PowerShell `$ExecutionContext` and variable drives to access the runtime environment via reflection methods (`Get-ChildItem`, `Get-Item`, `.Name-*like`). Such techniques are commonly used in obfuscated payloads to dynamically resolve and execute commands while evading detection. This behavior is associated with defense evasion tactics and fileless malware execution.

2025-02-14 00:00:00

None

9c45fe68-fa2a-4251-9d86-2b1c17b9f9bd

attack.defense-evasion attack.t1070.004 attack.t1059.001

Nextron Sigma feed only (private)