Fileless PowerShell iex(irm) In-Memory Execution with LogAction C2 Tasking (Kimsuky)

Ibrahim Saud@tektrix

•updated Jul 2, 2026•4•0•37

This rule detects PowerShell commands that exhibit characteristic patterns of downloading and executing remote scripts in memory. It specifically looks for the combination of 'Invoke-Expression' (IEX) with web-fetching cmdlets like 'Invoke-RestMethod' or 'irm', combined with specific argument indicators like 'checkservice.php', 'idx=5', or 'logaction' which are often associated with stage-delivery or dropper scripts.