Powershell Remote Rtf Retrieval Or Execution

Daniel Jeremiah@daniyyell

•updated Jun 19, 2026•0•0•1

This rule detects PowerShell processes attempting to retrieve or execute remote .rtf resources via web requests. It specifically looks for `powershell.exe` or `pwsh.exe` in the process path combined with command-line arguments indicating `Invoke-WebRequest`, `iwr`, `DownloadString`, `Invoke-Expression`, or `iex` targeting a URL ending in `.rtf`.