Powershell Module Clobbering

Tim Peck@timpeck

•updated Nov 4, 2025•6•3•101

Detects PowerShell command clobbering techniques, where a module is installed or imported with the intent to overwrite existing system commands. This can be used in supply chain attacks via repositories like PowerShell Gallery.