PowerShell Web Request and Code Execution

nomit vyas@xoxo

•updated Apr 30, 2026•0•48

Detects PowerShell processes executing web requests (Invoke-WebRequest, iwr, curl) followed by immediate code execution (iex, Invoke-Expression). This pattern is commonly used by adversaries to download and execute malicious scripts or payloads directly in memory, bypassing disk-based detection.