PowerShell IRM to IEX Execution

Kaung Khant Ko@kaungkhantko

•updated May 25, 2026•10•0•485

This rule detects PowerShell execution that combines 'irm' (Invoke-RestMethod) or 'Invoke-RestMethod' with 'iex' (Invoke-Expression) or 'Invoke-Expression'. This pattern is commonly used as a download cradle to fetch and execute malicious scripts or stage-2 infostealers, as observed in campaigns like the fake Gemini CLI installation script.