PowerShell Downloads Decoy Document.pdf from google.com then Opens It

Ibrahim Saud@tektrix

•updated Sep 21, 2026•1•0•4

Detects the use of PowerShell to perform a web request to google.com to download a file named Document.pdf, followed by the immediate execution of that downloaded file using Start-Process.