PS ExecutionContext Reflection Abuse

X__Junior

Detects attempts to abuse PowerShell `$ExecutionContext` and variable drives to access the runtime environment via reflection methods (`Get-ChildItem`, `Get-Item`, `.Name-*like`). Such techniques are commonly used in obfuscated payloads to dynamically resolve and execute commands while evading detection. This behavior is associated with defense evasion tactics and fileless malware execution.

2025-02-14 00:00:00

None

a8e3ed21-549b-4b27-aefe-08cfac53897d

attack.defense-evasion

Nextron Sigma feed only (private)