PowerShell DownloadString piped to Invoke-Expression (NetSupport loader)

Ankit Mehta@Secvyn

•updated Sep 9, 2026•0•0•2

Detects the use of PowerShell to download string content from the internet and execute it immediately using Invoke-Expression (IEX). This is a common pattern for fileless malware delivery and secondary stage payload execution.