examples:

• description: "Execute Snow Inventory Agent for Windows and observe the unusual behavior" command: "Snow Inventory Agent for Windows"

Snow Inventory Agent for Windows

Yet another PowerShell weirdo.

Snow Inventory Agent for Windows (snowagent.exe) runs PowerShell which resembles shellcode (bindshell)

• powershell.exe -command
• Invoke-Expression
• byte arrays
• string encoding operations
• pipes.

Contributed by Luke Humberdross (@ukejjh)