PowerShell Download Cradle with Immediate Execution

Jorden Smith@Jorden

•updated Feb 10, 2026•0•29

Detects PowerShell download cradles that use commands like Invoke-RestMethod, Invoke-WebRequest, iwr, irm, curl, wget, Net.WebClient, DownloadString, DownloadData, or Start-BitsTransfer to download content, immediately followed by execution via Invoke-Expression or IEX. This technique is often used for fileless malware execution.