Suspicious PowerShell HTTP Usage Writing to AppData or Temp

Marcus Mingo@meeengoh

•updated Dec 1, 2025•8•1•95

Detects PowerShell command lines that reference HTTP/HTTPS content together with environment-backed AppData or Temp paths (e.g. %APPDATA%, $env:APPDATA, %TEMP%, $env:TEMP), a common pattern for downloading or staging payloads in user-writable directories.