T1059.001

Command and Scripting Interpreter: PowerShell

discovered 2026-06-17

worker.js execution fallback chain includes PowerShell Start-Process -WindowStyle Hidden.

View on MITRE ATT&CK

Seen in packages

Campaigns