SmartApeSG - IWR / IEX combined with WidgetTicks

Ibrahim Saud@tektrix

•updated Jun 19, 2026•0•0•1

This rule detects PowerShell processes executing 'Invoke-WebRequest' (IWR) or 'IEX' (Invoke-Expression) commands that establish network connections to the domain 'wigetticks.com'. This combination indicates potential adversary activity involving downloading and executing malicious content from a specific attacker-controlled infrastructure, as identified in the SmartApeSG campaign.