Skip to content
skopnix
Detections · Rule
← IBM QRadar detectionsIBM QRadar · Behaviour (ATT&CK technique)

PowerShell download cradle executed from the command line (T1059.001)

AQLhighconfidence 80/100generated 2026-10-18

powershell.exe / pwsh.exe whose command line both downloads (Net.WebClient DownloadString / DownloadFile / DownloadData) and executes (IEX / Invoke-Expression) — the classic in-memory loader. Observed for: APT-C-36, APT10, APT19, APT27, APT28, APT29 and 71 more.

ATT&CK
T1059.001 mitre ↗
Linked actors
APT-C-36 · APT10 · APT19 · APT27 · APT28 · APT29 · APT3 · APT32 · APT33 · APT35 · APT39 · APT40 · APT42 · APT5 · blackbyte · Blue Mockingbird · BRONZE HIGHLAND · BRONZE STARLIGHT · Chimera · Cobalt · Confucius · CopyKittens · DarkHydrus · DarkVishnya · DustSquad · Earth Kapre · Earth Lusca · ENERGETIC BEAR · FIN10 · FIN13 · FIN6 · FIN8 · Fox Kitten · GALLIUM · Gallmaker · Gamaredon Group · GOLD SOUTHFIELD · HAFNIUM · Inception Framework · INDRIK SPIDER · Kimsuky · LazyScripter · LYCEUM · Medusa Group · Molerats · MoustachedBouncer · MuddyWater · OilRig · play · Poseidon Group · QUILTED TIGER · RAZOR TIGER · SaintBear · Sandworm · Scattered Spider · Silence group · Stealth Falcon · Storm-0501 · Storm-1567 · TA2541 · TA459 · TA505 · TeamTNT · The Gorgon Group · Thrip · Tick · ToddyCat · Tonto Team · Tortoiseshell · Turla · UNC3886 · UNC4393 · Void Manticore · Volt Typhoon · Winter Vivern · WIRTE · WIZARD SPIDER
False positives
All three conditions must hold (PowerShell binary, a download method, an execute verb); plain Invoke-WebRequest file downloads and encoded management scripts do not match.

AQL search

skopnix-qradar-ttp-t1059-001-6092a73d.aqldownload .aql ↓
SELECT DATEFORMAT(starttime, 'yyyy-MM-dd HH:mm:ss') AS event_time, LOGSOURCENAME(logsourceid) AS log_source, sourceip, username, "Process Name", "Process CommandLine"
FROM events
WHERE ("Process Name" ILIKE 'powershell.exe' OR "Process Name" ILIKE 'pwsh.exe') AND ("Process CommandLine" ILIKE '%.downloadstring(%' OR "Process CommandLine" ILIKE '%.downloadfile(%' OR "Process CommandLine" ILIKE '%.downloaddata(%') AND ("Process CommandLine" ILIKE '%iex%' OR "Process CommandLine" ILIKE '%invoke-expression%')
LAST 7 DAYS

CRE rule (build in Offenses > Rules)

download .txt ↓
Rule name: "Skopnix: PowerShell download cradle executed from the command line (T1059.001)"
Rule type: Event
Test stack:
  - and when the event(s) were detected by one or more of [Microsoft Windows Security Event Log, Microsoft Windows Sysmon]
  - and when the event matches this AQL filter query: ("Process Name" ILIKE 'powershell.exe' OR "Process Name" ILIKE 'pwsh.exe') AND ("Process CommandLine" ILIKE '%.downloadstring(%' OR "Process CommandLine" ILIKE '%.downloadfile(%' OR "Process CommandLine" ILIKE '%.downloaddata(%') AND ("Process CommandLine" ILIKE '%iex%' OR "Process CommandLine" ILIKE '%invoke-expression%')
Response: dispatch new event / create offense indexed by Source IP; annotate "Skopnix T1059.001".
FP-safety: All three conditions must hold (PowerShell binary, a download method, an execute verb); plain Invoke-WebRequest file downloads and encoded management scripts do not match.

How to deploy on IBM QRadar

  1. 1.Create the reference set from its spec (Reference Data API, or Admin > Reference Set Management) and schedule the skopnix feed load.
  2. 2.Paste the AQL into Log Activity > Advanced Search to hunt the last seven days.
  3. 3.For alerting, build the CRE rule from the test stack shown and exclude your known-good building block.

Check · Custom properties ("URL Host", "URL", "File Hash", "Process CommandLine") come from your DSMs and content extensions; rename them if yours differ.

References