TF-MAL-ps1.powershortshell

Description

ThreatFox malware family `ps1.powershortshell`. Printable name: PowerShortShell.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (1)

• ThreatFox: IOCs for this family ThreatFox Malwares

• Hackers Weaponizing PowerShell & Microsoft Legitimate Apps To Deploy ...
  web:cybersecuritynews.com

  Cybersecurity experts have recently observed a concerning trend in attack methodologies, with threat actors increasingly leveraging fileless techniques that weaponize PowerShell and legitimate Microsoft applications to deploy malware while evading detection. These sophisticated attacks operate primarily in memory, leaving minimal forensic evidence and bypassing traditional security solutions ...

  2026-05-22 05:31 UTC
• Powershell detected as malware - Resolved Malware Removal Logs ...
  web:forums.malwarebytes.com

  Hello, I have malwarebytes identifying powershell.exe as malware . I'm unsure if it's a false positive? It keeps popping up every 5 min but running the threat scan both for Malwayebytes and others comes out empty. I'm attaching the screenshot of the popup. My system is running on Windows 11 and it...

  2026-05-22 05:31 UTC
• powershell-malware · GitHub Topics · GitHub
  web:github.com

  A PowerShell-based malware designed to completely disable all Windows security features, featuring UAC bypass and advanced anti-virtualization techniques. Built to operate both as a standalone PowerShell script and as a compiled executable (.exe) for maximum flexibility and stealth. A PowerShell ...

  2026-05-22 05:31 UTC
• Remediate vulnerabilities with Microsoft Defender Vulnerability ...
  web:learn.microsoft.com

  Remediate security weaknesses discovered through security recommendations, and create exceptions if needed, in Defender Vulnerability Management.

  2026-05-22 05:31 UTC
• Detecting Malicious PowerShell Scripts
  web:letsdefend.io

  Understanding PowerShell-Based Cyber Attacks PowerShell is a legitimate tool used in enterprise environments for various administrative tasks. However, its ability to bypass traditional security controls, combined with obfuscation techniques, makes it a popular choice for attackers. PowerShell scripts can be used to perform various malicious actions such as executing malware , bypassing ...

  2026-05-22 05:31 UTC
• ViperSoftX Evolves: New PowerShell Malware - Active IOCs
  web:rewterz.com

  A newly discovered variant of the ViperSoftX malware family emerged in early 2025, representing a significant shift in both tactics and sophistication. This PowerShell-based stealer showcases a high degree of modularity, stealth, and resilience, signaling a departure from its earlier, more basic 2024 version.

  2026-05-22 05:31 UTC
• PowerShell - Malware Analysis For Hedgehogs
  web:struppigel.github.io

  PowerShell malware is commonly a dropper or downloader for the actual payload which means they are often rather at the beginning of the infection chain. Because PowerShell runs on the .NET Common Language Runtime, it is easy to dynamically load and execute .NET assemblies via PowerShell, making this a common target of PowerShell malware .

  2026-05-22 05:31 UTC
• Malware Incident Response: The 7-Step Playbook for 2025 - Breachsense
  web:www.breachsense.com

  Complete malware remediation now requires addressing both the infected endpoint and the stolen authentication data. Your malware incident response playbook must account for both.

  2026-05-22 05:31 UTC
• Technical Approaches to Uncovering and Remediating Malicious ... - CISA
  web:www.cisa.gov

  It highlights technical approaches to uncovering malicious activity and includes mitigation steps according to best practices. The purpose of this report is to enhance incident response among partners and network administrators along with serving as a playbook for incident investigation.

  2026-05-22 05:31 UTC
• Mitigating malware and ransomware attacks - The National Cyber Security ...
  web:www.ncsc.gov.uk

  This guidance helps private and public sector organisations deal with the effects of malware (which includes ransomware). It provides actions to help organisations prevent a malware infection, and also steps to take if you're already infected. Following this guidance will reduce: the likelihood of becoming infected the spread of malware throughout your organisation the impact of the infection

  2026-05-22 05:31 UTC

Only Available for Registered Users. Sign in to view.