ClearFake PowerShell IEX IRM Stager

Ibrahim Saud@tektrix

•updated Jun 17, 2026•1•0•10

Detects ClearFake PowerShell stager using 'iex' (Invoke-Expression) and 'irm' (Invoke-RestMethod) with '-UseBasicParsing'. This combination is often used by malware to download and execute scripts from the internet, bypassing more robust parsing mechanisms.