All Detections

PowerShell DownloadFile

avatar
Google SecOps@GoogleSecOps
updated Jun 6, 2025000

Detects the execution of powershell, a WebClient object creation and the invocation of DownloadFile in a single command line

YARA-L