Skip to content
Threat Feed

Tag

Tabexpansion

1 brief RSS
medium advisory

Suspicious PowerShell TabExpansion Direct Call

This detection identifies PowerShell scripts that directly call the TabExpansion internal function, which is uncommon and may indicate malicious activity, such as TabShell, potentially bypassing sandboxes by loading PowerShell functions via directory traversal.

Splunk Enterprise +2 powershell tabexpansion bypass endpoint
2r 2t