Suspicious PowerShell Download and Rundll32 Execution

Ethan Andrews@eandrews

•updated May 27, 2026•12•0•82

Detects PowerShell utilizing Invoke-WebRequest (iwr) to download a payload and subsequently executing it via Start-Process using rundll32 with the specific 'Begin' export function. This execution pattern is the primary secondary stage for the recent Ghost CMS ClickFix campaigns delivering information stealers.