PowerShell downloads decoy PDF then Start-Process launches it

Ibrahim Saud@tektrix

•updated Sep 21, 2026•0•0•6

Detects the use of PowerShell to download a file named Document.pdf using Invoke-WebRequest, saving it to disk, and immediately executing it using Start-Process. This behavior is indicative of a dropper or secondary stage payload execution pattern.