PowerShell Invoke-WebRequest to S3 with 'usoshared'

Jeremy Goldstein@jeremys1

•updated Apr 22, 2026•7•0•434

Detects PowerShell processes executing 'Invoke-WebRequest' with command-line arguments containing 's3' and 'usoshared'. This combination could indicate an attempt to download or interact with S3 buckets, potentially for data exfiltration, staging, or retrieving malicious payloads, specifically referencing 'usoshared' which might be a specific bucket name or a keyword used by certain threat actors.