InstallFix - RC4 Decryption Routine Execution (T1140)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•2•0•5

Hunts for custom PowerShell RC4 decryption routines utilizing hardcoded byte arrays to unhook AMSI or decode subsequent stages. This rule specifically looks for PowerShell command text containing patterns indicative of byte array assignments (e.g., `]$var = 0x...`) and the `bxor` operator, which is commonly used in RC4 decryption routines.