GLASSWORM PowerShell Download Cradle Detection

Ethan Andrews@eandrews

•updated Jun 18, 2026•5•0•15

Identifies execution of the Windows PowerShell cradle used by GLASSWORM's WASM loader. It looks for 'irm' (Invoke-RestMethod) fetching a URL containing the specific '/win32/i/_' path structure, piped to 'iex' (Invoke-Expression). This pattern is indicative of the GLASSWORM malware's initial payload delivery mechanism.