Operation Poisson RevS.ps1 PowerShell Reverse Shell Execution

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•6

Detects the execution of the 'RevS.ps1' PowerShell reverse shell, identified by its filename, SHA256 hash, or characteristic command-line arguments such as encoded commands or the use of 'ExecutionPolicy Bypass' combined with download cradle patterns (IEX, Invoke-Expression, DownloadString).