huntrule

Suspicious PowerShell Download and Execute via iwr Piped to iex

PremiumReviewedSigma · Medium · v1
Product
windows
Category
process_creation
Author
HuntRule
Published
2026-10-15
Updated
2026-10-15
AnalysisDetection

ATT&CK techniques

Execution

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects PowerShell fetching remote content with Invoke-WebRequest and piping it into Invoke-Expression, a loader pattern used to deliver StealC and Amadey infostealers. Downloading and directly executing script content in memory bypasses file based controls and is a common malware staging technique.

Reporting behind it

Related detections9 linkedT1059.001 — drag to rearrange
Suspicious ScreenConnect Remote Access Client Spawning PowerShell (via process_creation)
Suspicious APT42 SMB Share Discovery via Invoke-HuntSMBShares (via ps_script)
Suspicious Scheduled Task Launching rundll32 DLL via Ransomware
Suspicious Child Process Spawned by Triofox GladinetCloudMonitor
Suspicious PowerShell Loader Spawned by mshta via UNC5142 ClickFix
Suspicious ClickFix Clipboard PowerShell Execution from Run Dialog
Suspicious PEAKLIGHT Memory-Only PowerShell Downloader Flags (via process_creation)
Malicious Active Directory ACL Manipulation via PowerView
Suspicious PowerShell Reading Base64 Payload from MI_V Environment Variable via process_creation
Suspicious PowerShell Download and Execute via iwr Piped to iex
Pivot detection · T1059.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.