PowerShell Application Enumeration for Reconnaissance

Ethan Andrews@eandrews

•updated Jun 18, 2026•6•0•38

Detects PowerShell execution patterns used for host reconnaissance and application enumeration, specifically looking for combinations of Get-StartApps and Get-AppxPackage with silent error handling. This behavior was observed in the easy-day-js malware dropped via the Mastra npm supply chain compromise.