LNK-Spawned PowerShell Downloading VelvetCake Loader Files

Ibrahim Saud@tektrix

•updated Sep 23, 2026•0•0•7

Detects the execution of PowerShell or PowerShell Core (pwsh) triggered by common Windows shell applications (explorer, mshta, wscript, cscript) where the command line contains indicators associated with the downloading of VelvetCake stager files, including specific GitHub raw content URLs or AppData paths referencing known stager filenames.