← All detection heuristics · Script
critical
LNK_POWERSHELL_BIGINT_NETWORK_ENDPOINT
What it means
A shortcut reconstructs a downloader endpoint from large integer arithmetic.
Why it fires
The PowerShell arguments subtract large integer constants and repeatedly take remainder/divide by 256 to rebuild endpoint bytes before passing them to a network retrieval primitive. Detection is bounded and requires the complete arithmetic loop, a valid domain/path result, a script interpreter, and a downloader command.
Other Script heuristics
SCRIPT_WSH_OBFUSCATED WINDOWS_PS_ADDTYPE_WINAPI_TAMPER WINDOWS_PS_SCREENSHOT_UPLOAD_EXFIL WINDOWS_SCRIPT_CERTUTIL_RUNDLL_CHAIN SCRIPT_WSH_STREAM_WRITE_RUN_CHAIN WINDOWS_SCHEDULED_TASK_SCRIPT_EXEC WINDOWS_SCRIPT_BASE64_BINARY_DROPPER LNK_SCRIPT_DOWNLOADER MACOS_ZSH_LOADER SCRIPT_HEAVY_STRING_DECODER_OBFUSCATION SCRIPT_WSH_MASQUERADE LNK_HIDDEN_SCRIPT_EXEC