Storm-2561 - SEO Lure to PowerShell Payload Fetch

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•3

This rule detects a scenario where a user downloads a fake installer (e.g., setup, install, vpn executable) from a browser, and shortly after, the downloaded executable initiates a PowerShell process. This PowerShell process then attempts to fetch secondary payloads from known malicious hosting services like Discord or Pastebin using `Invoke-WebRequest` or `IEX`.