All Detections

PowerShell DownloadFile

Yamato Security Hayabusa@YamatoSecurityHayabusa
updated Jun 24, 202505

Detects the execution of powershell, a WebClient object creation and the invocation of DownloadFile in a single command line

Sigma