Konni VelvetCake Fileless Execution via DownloadString and IEX

Ibrahim Saud@tektrix

•updated Sep 22, 2026•0•0•2

Detects execution of PowerShell commands indicative of the VelvetCake variant of the Konni malware. The rule identifies the use of 'Net.WebClient.DownloadString' combined with 'Invoke-Expression' (iex) to execute scripts in memory, alongside specific command-line indicators such as the 'Areyou=cake' campaign marker or associated C2 domains.