PowerShell WebClient/IWR Download-to-Temp Followed by Rapid Execution
Detects PowerShell (or pwsh) processes that both download a file to a temp-like location and subsequently execute or install it within a short time window on the same host, indicative of a staged loader/dropper download-and-execute pattern.
Cortex XDR
