Windows PowerShell Download and Execution Cradles
Flags PowerShell commands that download remote content and immediately execute it using IEX/Invoke-Expression.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-03-24
- Updated
- 2026-07-30
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies PowerShell command lines that combine common download functions (such as DownloadString, DownloadFile, Invoke-WebRequest, and Invoke-RestMethod) with execution via Invoke-Expression/IEX. This pattern is a common attacker technique to fetch remote content and immediately execute it in the same PowerShell context. The detection relies on Windows process creation telemetry, specifically the full CommandLine field for PowerShell processes.
Reporting behind it
- github.comhttps://github.com/VirtualAlllocEx/Payload-Download-Cradles/blob/88e8eca34464a547c90d9140d70e9866dcbc6a12/Download-Cradles.cmd
- labs.withsecure.comhttps://labs.withsecure.com/publications/fin7-target-veeam-servers
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_download_iex.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows PowerShell Download and Execution Cradles
id: 320e97a1-3c14-4b2f-8e30-3300b775748a
status: test
description: This rule identifies PowerShell command lines that combine common download functions (such as DownloadString, DownloadFile, Invoke-WebRequest, and Invoke-RestMethod) with execution via Invoke-Expression/IEX. This pattern is a common attacker technique to fetch remote content and immediately execute it in the same PowerShell context. The detection relies on Windows process creation telemetry, specifically the full CommandLine field for PowerShell processes.
references:
- https://github.com/VirtualAlllocEx/Payload-Download-Cradles/blob/88e8eca34464a547c90d9140d70e9866dcbc6a12/Download-Cradles.cmd
- https://labs.withsecure.com/publications/fin7-target-veeam-servers
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_download_iex.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-03-24
modified: 2025-07-18
tags:
- attack.execution
- attack.t1059
logsource:
product: windows
category: process_creation
detection:
selection_download:
CommandLine|contains:
- .DownloadString(
- .DownloadFile(
- "Invoke-WebRequest "
- "iwr "
- "Invoke-RestMethod "
- "irm "
selection_iex:
CommandLine|contains:
- ;iex $
- "| IEX"
- "|IEX "
- I`E`X
- I`EX
- IE`X
- "iex "
- IEX (
- IEX(
- Invoke-Expression
condition: all of selection_*
falsepositives:
- Some PowerShell installers were seen using similar combinations. Apply filters accordingly
level: high
license: DRL-1.1
related:
- id: 85b0b087-eddf-4a2b-b033-d771fa2b9775
type: derived