RedVDS - Interactive Logon Running PowerShell Downloaders

Ibrahim Saud@tektrix

•updated Jun 21, 2026•1•0•9

Identifies an interactive logon session established from a RedVDS IP executing PowerShell downloaders to pull secondary payloads. This rule correlates process execution events for PowerShell with specific command-line patterns indicative of downloading content (Net.WebClient or DownloadString) with interactive logon events originating from a known RedVDS IP address.