Suspicious PowerShell Download Cradle

Tim Peck@timpeck

•updated Dec 8, 2025•14•1•267

Detects PowerShell being used with an encoded command that contains download and execution primitives. This is a common technique used by adversaries, including in the exploitation of CVE-2025-55182 (React2Shell), to download and run second-stage payloads in memory.