Windows Process Execution for PowerShell Cobalt Strike Download via Hidden IEX
Flags PowerShell command lines that use IEX and hidden downloadstring to fetch a Cobalt Strike payload.
FreeReviewedSigma · High · v5
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-11-09
- Updated
- 2026-07-31
What it detects
This rule flags Windows process creation events whose command line contains a PowerShell hidden, no-profile execution pattern that runs IEX with a WebClient downloadstring to retrieve remote content. Such behavior is commonly used by attackers to stage payloads like Cobalt Strike without writing a dropper to disk. It relies on process creation telemetry with command-line visibility to match the specific execution string.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-process-creation-powershell-downloadstring-used-to-fetch-cobalt-strike-aa5b0a40
title: Windows Process Execution for PowerShell Cobalt Strike Download via Hidden IEX
id: d2de70a1-1d77-4e7b-8b46-ba0b2c043768
status: test
description: This rule flags Windows process creation events whose command line contains a PowerShell hidden, no-profile execution pattern that runs IEX with a WebClient downloadstring to retrieve remote content. Such behavior is commonly used by attackers to stage payloads like Cobalt Strike without writing a dropper to disk. It relies on process creation telemetry with command-line visibility to match the specific execution string.
references:
- https://www.sysaid.com/blog/service-desk/on-premise-software-security-vulnerability-notification
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/Lace-Tempest/proc_creation_win_apt_lace_tempest_cobalt_strike_download.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-11-09
tags:
- attack.execution
- detection.emerging-threats
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine|contains|all:
- -nop -w hidden -c IEX ((new-object net.webclient).downloadstring(
- /a')
condition: selection
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: aa5b0a40-ed88-46aa-9fdc-0337b379ca9d
type: derived