PowerShell char-code array building TEMP dir path (obfuscation)

Ankit Mehta@Secvyn

•updated 25 days ago•0•0•0

Detects the execution of PowerShell commands that use character-based obfuscation to call 'CreateDirectory' and interact with the user's temporary environment folder. This pattern is commonly observed when scripts attempt to hide file staging or payload delivery paths from static analysis.