Remote deploy.ps1 download via PowerShell irm|iex cradle from attacker infrastructure

Arnold Chan@slaz

•updated Sep 8, 2026•1•0•3

This rule detects inbound HTTP GET requests to a specific IP address (103.86.86.244) requesting a file named 'deploy.ps1'. This behavior is characteristic of adversaries using PowerShell one-liners (cradles) like 'irm' (Invoke-RestMethod) or 'iex' (Invoke-Expression) to fetch and execute malicious scripts directly from a remote C2 infrastructure.