PowerShell DownloadString Execution

Ankit Mehta@Secvyn

•updated Jun 30, 2026•1•0•4

This rule detects multiple instances of PowerShell executing commands that include 'DownloadString' within a one-hour window on the same computer and by the same account. This behavior is often associated with adversaries attempting to download and execute malicious scripts or files from remote sources.