Fileless PowerShell Download and Execute Cradle
Detects the use of PowerShell to perform a fileless download-and-execute operation, characterized by the presence of web-based download cmdlets alongside in-memory execution primitives. This pattern is commonly used for staging malicious payloads such as Cobalt Strike, Sliver, or other offensive tooling while avoiding file-based detection.
Microsoft Sentinel (KQL)
