PowerShell Download Cradle Fetching RUSTYSHADE from Backblaze B2

Ibrahim Saud@tektrix

•updated Sep 20, 2026•0•0•2

This rule detects PowerShell processes attempting to download specific ZIP files (e.g., DriverInstaller.zip, Automata-20.zip, ww.zip) from Backblaze B2 cloud storage buckets. This pattern is commonly associated with the delivery of malicious payloads or staged tools.