InstallFix Persists a PowerShell Downloader at User Logon

Daniel Jeremiah@daniyyell

•updated Jun 20, 2026•0•0•7

Detects a logon task or Run value that starts PowerShell with a network retrieval expression rather than a local administrative script. This rule specifically looks for modifications to registry run keys that include PowerShell or pwsh commands attempting to download content using methods like Invoke-WebRequest, DownloadString, DownloadFile, Net.WebClient, or curl.