PowerShell Download and File Creation Correlation ( DriveSurge )

Ankit Mehta@Secvyn

•updated Jun 2, 2026•1•0•4

This rule detects suspicious activity involving PowerShell downloading content (using Invoke-WebRequest, iex, or DownloadString) followed by the creation of specific suspicious files (Browser Update.exe, update.zip, update.msi) on the same device within a 10-minute window. This correlation suggests a potential ingress of malicious tools or updates.