Netskope Threat Labs

PowerShell

ATP Sandbox Adv. HeuristicsAVNetskope IPS

Description

This generic detection identifies malicious PowerShell scripts that perform unauthorized actions on infected systems.

Stats

First seen
March 2022
Last seen
October 2026

Also known as

Powershell

Alert name variants

Alert Name
Binary.Trojan.PowerShell
DeepScan:Generic.Powershell.Downloader.A.FFFFFFFE
DeepScan:Generic.Powershell.Injector.B.FFFFFFFE
Document-XML.Trojan.PowerShell
Dropped:Trojan.PowerShell.Downloader.BG
Dump:Generic.Powershell.Injector.B.FFFFFFFE
Email-MIME.Trojan.PowerShell
Generic.Brutel.Powershell.A.6DC30F15
Generic.Hacktool.PowerShell.A.ED4CD17F
Generic.Powershell.Downloader.A.044153F8

Related IPS Signatures

Signature Name
MALWARE-CNC PowerShell Empire HTTP listener response
MALWARE-CNC PowerShell Empire variant outbound connection
MALWARE-CNC UNC6923 PowerShell implant C2 beacon detected
MALWARE-CNC Win.PowerShell.C2.Slopoly command request detected
MALWARE-CNC Win.PowerShell.C2.Slopoly heartbeat beacon detected
MALWARE-CNC Win.PowerShell.Stager C2 hardcoded persistence marker detected
MALWARE-TOOLS Powershell AMSI bypass toolkit download attempt