PowerShell Download Cradle HTTP Activity Detection

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•4

Detects outbound network traffic from internal hosts exhibiting characteristics of PowerShell-based download cradles, such as specific User-Agent strings or URL patterns associated with IEX DownloadString or Invoke-WebRequest.