PowerShell Download and Execution Cradles

Title: PowerShell Download and Execution Cradles
Status: test
Description:Detects PowerShell download and execution cradles.
References:
  -https://github.com/VirtualAlllocEx/Payload-Download-Cradles/blob/88e8eca34464a547c90d9140d70e9866dcbc6a12/Download-Cradles.cmd
  -https://labs.withsecure.com/publications/fin7-target-veeam-servers
Author: Florian Roth (Nextron Systems)
Date: 2022-03-24
modified:2025-07-18
Tags:

• -'attack.execution'
• -'attack.t1059'

Logsource:

• product: windows
• category: process_creation

Detection:
  selection_download:
    CommandLine|contains:
      -'.DownloadString('
      -'.DownloadFile('
      -'Invoke-WebRequest '
      -'iwr '
      -'Invoke-RestMethod '
      -'irm '

  selection_iex:
    CommandLine|contains:
      -';iex $'
      -'| IEX'
      -'|IEX '
      -'I`E`X'
      -'I`EX'
      -'IE`X'
      -'iex '
      -'IEX ('
      -'IEX('
      -'Invoke-Expression'

  condition:all of selection_*
Falsepositives:
  -Some PowerShell installers were seen using similar combinations. Apply filters accordingly
Level: high