huntrule

Suspicious PowerShell Remote Payload Download via IEX DownloadString

PremiumReviewedSigma · Medium · v1
Product
windows
Category
process_creation
Author
HuntRule
Published
2026-09-11
Updated
2026-09-11
AnalysisDetection

ATT&CK techniques

Execution

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects PowerShell invoking Invoke-Expression together with a WebClient DownloadString call which the attackers used to fetch and execute in memory payloads during the campaign targeting Japan. Combining remote content download with immediate expression execution is a common fileless delivery technique.

Reporting behind it

Related detections9 linkedT1059.001 — drag to rearrange
Malicious PowerShell Spawned by PHP CGI Process
Malicious Shadow Copy Deletion Via WMI
Suspicious Script Host Spawning PowerShell With Bypass And Hidden Execution
Suspicious PS1Bot PowerShell Payload Written to ProgramData (via file_event)
Suspicious PowerShell Execution via SyncAppvPublishingServer LOLBIN
Suspicious Scheduled Task Running PowerShell Every Minute (via process_creation)
Malicious Script Host Spawning PowerShell With Invoke-Expression (via process_creation)
Hidden PowerShell Archive Extraction via ExtractToDirectory
CastleLoader ClickFix PowerShell Hex Decode and Re-Execution
Suspicious PowerShell Remote Payload Download via IEX DownloadString
Pivot detection · T1059.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.