Netskope Threat Labs

RefA

ATP Sandbox Adv. HeuristicsAV

This generic detection identifies malicious PowerShell scripts that perform reconnaissance and download additional payloads.

First seen
February 2022
Last seen
October 2026
Alert Name
DeepScan:Generic.PwShell.RefA.FFFFFFFE
Dump:Generic.PwShell.RefA.FFFFFFFE
Generic.PwShell.RefA.002C6C31
Generic.PwShell.RefA.01E4C5A9
Generic.PwShell.RefA.020B34A2
Generic.PwShell.RefA.0297A95F
Generic.PwShell.RefA.031C392A
Generic.PwShell.RefA.0336D5C9
Generic.PwShell.RefA.036FD885
Generic.PwShell.RefA.04249B5C