Rule Info
Name
PowerShell Script Execution From Environment Variable - ScriptBlock
Author
Swachchhanda Shrawan Poudel (Nextron Systems)
Description
Detects PowerShell loading and executing a script stored inside an environment variable.
Attackers use this to hide the malicious code from command-line logs and security tools,
since the actual script is never written to disk or shown in the process arguments.
Reference
Date
2026-09-08 00:00:00
Modified
None
Id
ef427c41-3cba-4982-8da0-6b9178f68853
Tags
attack.execution attack.t1059.001 attack.stealth attack.t1027.010
Type
Nextron Sigma feed only (private)
Rule History
Scan your endpoints, forensic images or collected files with our portable scanner THOR