PowerShell Download and Execute Pattern Detection

F S@Fsdr

•updated May 5, 2026•25•1•410

This rule detects common PowerShell patterns used for downloading content from the internet and then executing it. It looks for a combination of download-related commands/objects (e.g., DownloadString, Invoke-WebRequest, Net.WebClient) and execution-related commands/objects (e.g., IEX, Invoke-Expression, Invoke-Command, ScriptBlock) within PowerShell command-line activity. This behavior is frequently observed in malware and adversary tradecraft for initial access, execution, and persistence.