Ransomware Series: PowerShell Download Cradle & Encoded Command Execution
Detects the execution of PowerShell with encoded command arguments (e.g., -enc, -EncodedCommand) combined with common web-request cmdlets or download-cradle patterns (e.g., IEX, Net.WebClient, Invoke-WebRequest). This pattern is frequently used by adversaries to execute obfuscated remote payloads in memory.
Microsoft Sentinel (KQL)
