PowerShell Download and Execute Cradle Associated With PhantomCaptcha
Detects the use of a PowerShell download cradle, a technique observed in the PhantomCaptcha campaign to download and execute a next-stage payload. This pattern often involves stealthy flags to evade detection.
Sigma
