PowerShell Download Cradle with Stealth Flags (WebClient/IWR/BitsTransfer)

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•0

Detects the execution of PowerShell or PWSH attempting to download external content via web-oriented cmdlets (Net.WebClient, Invoke-WebRequest, Start-BitsTransfer) using typical obfuscation flags (e.g., -WindowStyle Hidden).