Suspicious PowerShell Download Cradle Execution

Bryant Smith@flowstate

•updated Apr 21, 2026•10•0•307

Detects the execution of PowerShell using the ExecutionPolicy Bypass flag combined with the Net.WebClient DownloadFile method. This pattern is frequently used by threat actors and ransomware affiliates, such as The Gentlemen RaaS, to stage payloads from internal or external servers.