Dropping Elephant PowerShell Obfuscation

Ethan Andrews@eandrews

•updated Jun 17, 2026•5•0•13

Identifies string splitting techniques used in Dropping Elephant downloaders to evade static PowerShell logging. The rule specifically looks for obfuscated substrings like 'iw''r', 'g''c''i', 'r''e''n', 'c''p''i', and 'g''cm sch' within PowerShell command lines.