Potemkin Loader - IWR Execution from Explorer (T1059.001)
Specifically flags Invoke-WebRequest being launched directly from the Explorer shell context, bypassing normal script delivery to pull the Potemkin loader.
Microsoft Sentinel (KQL)
Specifically flags Invoke-WebRequest being launched directly from the Explorer shell context, bypassing normal script delivery to pull the Potemkin loader.
Already have an account?