Explorer.exe Spawns PowerShell with Network Download Command

Jorden Smith@Jorden

•updated Feb 10, 2026•0•14

This rule detects when 'explorer.exe' spawns PowerShell, and the PowerShell command line contains indicators of network communication for downloading content. Specifically, it looks for HTTP/HTTPS URLs or common PowerShell cmdlets and aliases used for web requests and file downloads (e.g., 'iwr', 'Invoke-WebRequest', 'wget', 'curl', 'DownloadString', 'DownloadFile', 'WebClient', 'Net.WebClient', 'BitsTransfer', 'Start-BitsTransfer', 'Invoke-RestMethod'). This behavior can indicate the execution of a download cradle, often used in initial access or command and control phases to retrieve additional malicious payloads.