Saw Powershell used recently for a Redline Stealer bootstrap. Someone made a game repack with "Advanced Installer" which is legit, but added a plugin DLL which

Saw Powershell used recently for a Redline Stealer bootstrap. Someone made a game repack with "Advanced Installer" which is legit, but added a plugin DLL which lets them run PS with the same privileges. The installer was digitally signed and requested admin, since it was an installer of course. The first thing the PS script did was to add Windows Defender exceptions to hide itself. And it worked beautifully. All the rest of the downloading, decrypting, and making the scheduled task to start Redline at user login succeeded. The only tipoff was seeing Powershell.exe in task manager with a base64 encoded command line argument. Any sufficiently advanced system administration tool is also powerful enough for a worm. The whole experience reminds me a lot of those early worms in the 2000s.