PowerShell Deobfuscation (Bubble String Removal)

Ethan Andrews@eandrews

•updated Jun 16, 2026•4•0•18

Detects PowerShell process executions that include the string 'bubble' in combination with string manipulation functions ('replace', 'split') or a campaign-specific function ('otidiform'). This pattern is indicative of attempts to deobfuscate PowerShell commands, often used by adversaries to hide malicious code.