PowerShell Direct IP Download Cradle Execution

F S@Fsdr

•updated Jul 17, 2026•21•1•24

Detects the use of PowerShell commands 'irm' (Invoke-RestMethod) or 'iwr' (Invoke-WebRequest) to download content from a direct IP address. This pattern is commonly used by attackers to stage malicious payloads or tools directly from external infrastructure, bypassing domain-based reputation filters.