ChainShell PowerShell Deployer Execution

Ibrahim Saud@tektrix

•updated Jun 17, 2026•0•0•2

Detects the execution of 'reset.ps1' via PowerShell, which has been identified as the ChainShell deployer script. This activity is associated with the MuddyWater threat group.