huntrule

Suspicious PowerShell Shellcode Loader via Function Pointer Delegate

PremiumReviewedSigma · High · v1
Product
windows
Category
ps_script
Author
HuntRule
Published
2026-10-21
Updated
2026-10-21
AnalysisDetection

ATT&CK techniques

Execution → Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects PowerShell that fetches remote content and invokes GetDelegateForFunctionPointer to execute shellcode. The AdaptixC2 framework uses Invoke-RestMethod to retrieve a beacon and this delegate call to run it in memory. Combining a network fetch with function pointer delegation is a hallmark of in-memory shellcode loaders.

Reporting behind it

Related detections9 linkedT1059.001 — drag to rearrange
Malicious PowerShell Runtime Loaded Outside PowerShell Host
Suspicious AutoIt Interpreter Launched by Script Host or Shell
Windows PowerShell Base64-encoded shellcode in ScriptBlockText
Suspicious PowerShell In-Memory Execution with AES Decryption
Malicious BeyondTrust Bomgar Agent Spawning Command Shell via Remote Support Exploitation (via process_creation)
Malicious WSUS Service Spawning Command Shell via CVE-2025-59287 (via process_creation)
Suspicious PowerShell Spawned by WScript via PhantomVAI Loader (via process_creation)
Suspicious MSBuild Execution Spawned by PowerShell via PhantomVAI Loader (via process_creation)
Suspicious PowerShell Download Spawned From Explorer via ClickFix (via process_creation)
Suspicious PowerShell Shellcode Loader via Function Pointer Delegate
Pivot detection · T1059.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.