PS1Bot Multi-Stage In-Memory PowerShell Download-Cradle with Multi-Host C2 Beaconing

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•2

Detects suspicious PowerShell processes initiated by common non-terminal applications (e.g., browser, office, script hosts) that perform in-memory code execution (using commands like IEX or System.Reflection) and simultaneously establish rapid network connections to multiple distinct external IP addresses within a one-minute window. This behavior is indicative of a staged payload download or beaconing activity.