REF8372 OXLOADER batch script spawning PowerShell with WebClient download cradle

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•1

Detects execution of PowerShell commands originating from a batch (.bat/.cmd) script that utilize .NET WebClient methods (DownloadString/DownloadFile) combined with process execution cmdlets (Start-Process/Invoke-Expression/IEX). This pattern is associated with the delivery and execution of the OXLOADER malware via BATPackageBuilderSetup.bat.