PowerShell WebClient fetch of staged .ps1 second-stage script

Ibrahim Saud@tektrix

•updated 13 days ago•0•0•2

Detects outbound HTTP GET requests containing a .ps1 file extension in the URI, originating from a host without a specified User-Agent, and targeting domains other than Microsoft or Windows Update. This pattern is characteristic of a persistence mechanism executing a PowerShell script to download a secondary payload (e.g., via Net.WebClient).