Obfuscated PowerShell Multi-Stage Loader Chain (ClickFix/StealC)

Ibrahim Saud@tektrix

•updated 27 days ago•1•0•5

Detects the execution of PowerShell with suspicious command-line arguments and obfuscation techniques commonly used by attackers to execute malicious code, including base64 encoded commands, bypass of execution policies, dynamic assembly loading, and caret-based obfuscation.