Suspicious PowerShell Download and Execution Cradle

Ethan Andrews@eandrews

•updated Jan 15, 2026•7•1•131

Detects the execution of PowerShell with command-line arguments containing keywords indicative of in-memory download and execution, such as '-enc' or '-EncodedCommand' used in conjunction with 'IEX' (Invoke-Expression) or 'DownloadString'. This pattern is a common TTP for initial access and second-stage payload delivery, and was observed in the exploitation of CVE-2025-55182 (React2Shell).