PowerShell User-Agent HTTP GET for .jpg Payload Carrier

Emiliano Mema@Nosalva

•updated Jul 17, 2026•0•0•9

Detects an outbound HTTP GET request containing a .jpg extension in the URI, initiated by a user agent string containing 'PowerShell'. This pattern is commonly associated with attackers downloading images intended to serve as carriers for steganographic payloads, which are then parsed or executed by malicious PowerShell scripts.