Malicious PowerShell Profile Delivered via HTTP

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•8

This rule detects the delivery of a malicious PowerShell profile script named 'profile.ps1' via HTTP. The rule specifically looks for the string 'IEX' (Invoke-Expression) within the file data, indicating an attempt to execute arbitrary commands. This technique is often used for persistence, where an attacker modifies a PowerShell profile to execute malicious code every time PowerShell is launched.