LOLBin or PowerShell Download Cradle Execution (bitsadmin, certutil, mshta, WebClient.DownloadString)
Detects the use of common Windows Living-off-the-Land Binaries (LOLBins) or PowerShell cmdlets typically utilized to download and execute remote payloads. The rule specifically monitors for BITSAdmin transfers, CertUtil URL cache retrievals, MSHTA remote execution, and PowerShell combined with WebClient/DownloadString and hidden windows.
Cortex XDR
