huntrule

Suspicious PowerShell IEX DownloadString In-Memory Execution via process_creation

PremiumReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
HuntRule
Published
2026-05-29
Updated
2026-08-28
AnalysisDetection

ATT&CK techniques

Execution

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects PowerShell that combines Invoke-Expression with the WebClient DownloadString method to fetch and run remote code entirely in memory. Head Mare and Twelve launched PowerShell with an execution policy bypass and hidden window to download and execute scripts including ADRecon. This fileless download and execute pattern is a common intrusion loader technique.

Reporting behind it

Related detections9 linkedT1059.001 — drag to rearrange
Suspicious Scheduled Task Running PowerShell Every Minute (via process_creation)
Malicious Script Host Spawning PowerShell With Invoke-Expression (via process_creation)
Hidden PowerShell Archive Extraction via ExtractToDirectory
CastleLoader ClickFix PowerShell Hex Decode and Re-Execution
Malicious Non-Interactive Encoded PowerShell Stager (via process_creation)
Malicious ActiveMQ Exploitation Java Spawning PowerShell Downloader (via process_creation)
Suspicious Cleo Autorun Health Check File Drop (via file_event)
Suspicious PowerShell Spawned by VBScript for RMM Delivery
Suspicious PowerShell Loading Fake Edge Update Script
Suspicious PowerShell IEX DownloadString In-Memory Execution via process_creation
Pivot detection · T1059.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.