Dragon Weave - PowerShell Decoding XOR Payloads

Ibrahim Saud@tektrix

•updated Jun 19, 2026•0•0•2

This rule detects PowerShell execution that includes specific command-line arguments consistent with decoding XOR-encoded payloads. It looks for 'powershell.exe' processes where the command line contains '-bxor' and references to files like 'Profile.ps1', '1.dat', or 'Com.dat', which are associated with the Dragon Weave campaign's decoding activities.