huntrule

Windows PowerShell Download and Execution Cradles

Flags PowerShell commands that download remote content and immediately execute it using IEX/Invoke-Expression.

FreeUnreviewedSigmahighv1
title: Windows PowerShell Download and Execution Cradles
id: 320e97a1-3c14-4b2f-8e30-3300b775748a
status: test
description: This rule identifies PowerShell command lines that combine common download functions (such as DownloadString, DownloadFile, Invoke-WebRequest, and Invoke-RestMethod) with execution via Invoke-Expression/IEX. This pattern is a common attacker technique to fetch remote content and immediately execute it in the same PowerShell context. The detection relies on Windows process creation telemetry, specifically the full CommandLine field for PowerShell processes.
references:
  - https://github.com/VirtualAlllocEx/Payload-Download-Cradles/blob/88e8eca34464a547c90d9140d70e9866dcbc6a12/Download-Cradles.cmd
  - https://labs.withsecure.com/publications/fin7-target-veeam-servers
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_download_iex.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-03-24
modified: 2025-07-18
tags:
  - attack.execution
  - attack.t1059
logsource:
  product: windows
  category: process_creation
detection:
  selection_download:
    CommandLine|contains:
      - .DownloadString(
      - .DownloadFile(
      - "Invoke-WebRequest "
      - "iwr "
      - "Invoke-RestMethod "
      - "irm "
  selection_iex:
    CommandLine|contains:
      - ;iex $
      - "| IEX"
      - "|IEX "
      - I`E`X
      - I`EX
      - IE`X
      - "iex "
      - IEX (
      - IEX(
      - Invoke-Expression
  condition: all of selection_*
falsepositives:
  - Some PowerShell installers were seen using similar combinations. Apply filters accordingly
level: high
license: DRL-1.1
related:
  - id: 85b0b087-eddf-4a2b-b033-d771fa2b9775
    type: derived

What it detects

This rule identifies PowerShell command lines that combine common download functions (such as DownloadString, DownloadFile, Invoke-WebRequest, and Invoke-RestMethod) with execution via Invoke-Expression/IEX. This pattern is a common attacker technique to fetch remote content and immediately execute it in the same PowerShell context. The detection relies on Windows process creation telemetry, specifically the full CommandLine field for PowerShell processes.

Known false positives

  • Some PowerShell installers were seen using similar combinations. Apply filters accordingly

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.