huntrule

Suspicious PowerShell Invoke-WebRequest and Invoke-Expression Download Cradle via ClickFix

PremiumReviewedSigma · Medium · v1
Product
windows
Category
ps_script
Author
HuntRule
Published
2026-07-02
Updated
2026-08-28
AnalysisDetection

ATT&CK techniques

Execution

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects PowerShell combining Invoke-WebRequest with Invoke-Expression to download and execute a payload in memory as seen in the ClickFix Revenge of detection campaign. This download cradle avoids writing the payload to disk and is triggered from a pasted Run dialog command. The pairing of remote fetch and dynamic execution is a strong malicious signal.

Reporting behind it

Related detections9 linkedT1059.001 — drag to rearrange
Suspicious Scheduled Task Running PowerShell Every Minute (via process_creation)
Malicious Script Host Spawning PowerShell With Invoke-Expression (via process_creation)
Hidden PowerShell Archive Extraction via ExtractToDirectory
CastleLoader ClickFix PowerShell Hex Decode and Re-Execution
Malicious Non-Interactive Encoded PowerShell Stager (via process_creation)
Malicious ActiveMQ Exploitation Java Spawning PowerShell Downloader (via process_creation)
Suspicious Cleo Autorun Health Check File Drop (via file_event)
Suspicious PowerShell Spawned by VBScript for RMM Delivery
Suspicious PowerShell Loading Fake Edge Update Script
Suspicious PowerShell Invoke-WebRequest and Invoke-Expression Download Cradle via ClickFix
Pivot detection · T1059.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.