MMC Executing PowerShell with Remote Download Pattern

nomit vyas@xoxo

•updated Jun 25, 2026•0•0•3

Detects the Microsoft Management Console (mmc.exe) spawning PowerShell with command-line arguments indicative of fileless execution, specifically using 'IEX' and 'DownloadString' or 'Net.WebClient' to retrieve and execute code from a remote location.