PowerShell Download Cradle via IEX and WebClient or DownloadString

Ankit Mehta@Secvyn

•updated Jun 27, 2026•0•0•2

Detects the use of PowerShell commands that leverage 'Invoke-Expression' (IEX) in conjunction with 'Net.WebClient' or 'DownloadString' methods to download and execute code directly from the internet into memory.