ATT&CK T1059.001 - PowerShell Download Cradle via HTTP

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•2

This rule detects HTTP requests that contain patterns indicative of a PowerShell download cradle. Specifically, it looks for 'powershell' and 'IEX' (Invoke-Expression) within the HTTP URI, suggesting an attempt to download and execute a script using PowerShell.