Fileless nyx.ps1 download via IEX to wipe forensic artifacts

Ankit Mehta@Secvyn

•updated 22 days ago•0•0•2

Detects the execution of PowerShell commands that reference the 'nyx' script from 'raw.githubusercontent.com', combined with common download and execution patterns such as 'Invoke-Expression' or 'Invoke-WebRequest'. This activity is consistent with retrieving and executing remote post-exploitation scripts.