PowerShell Dynamic Module Command Invocation via Index Access - PsScript

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects PowerShell scripts that dynamically invoke commands from the Microsoft.PowerShell.Utility module using index access on the ExportedCommands collection. Threat actors may use this technique to bypass detection mechanisms that look for specific command names, as the actual commands being invoked are determined at runtime and may not be explicitly mentioned in the script.

2026-05-11 00:00:00

None

a9c1d3e5-2f4b-6a7c-8d9e-0b1c2d3e4f5a

attack.execution attack.stealth attack.t1059.001 attack.t1027.010

Nextron Sigma feed only (private)