PowerShell process injection into csc.exe/chrome.exe/msedge.exe (StealC)

Ibrahim Saud@tektrix

•updated Sep 18, 2026•0•0•0

Detects instances of PowerShell executing process injection techniques (such as memory allocation and remote thread creation) targeting specific legitimate processes including csc.exe, chrome.exe, msedge.exe, or SearchIndexer.exe. This activity is indicative of the StealC malware attempting to masquerade its malicious code execution within trusted system or browser processes.