TASK#STOMP: .dat Base64 in-memory PowerShell loader

Ankit Mehta@Secvyn

•updated 18 days ago•0•0•1

Detects suspicious PowerShell command lines that load a .dat file, decode its Base64 content, and execute it in-memory. This behavior is indicative of the 'TASK#STOMP' loader pattern, where malicious code is hidden in external files and invoked directly into memory to bypass traditional file-based security controls.