Rule name: "Skopnix: PowerShell download cradle executed from the command line (T1059.001)"
Rule type: Event
Test stack:
  - and when the event(s) were detected by one or more of [Microsoft Windows Security Event Log, Microsoft Windows Sysmon]
  - and when the event matches this AQL filter query: ("Process Name" ILIKE 'powershell.exe' OR "Process Name" ILIKE 'pwsh.exe') AND ("Process CommandLine" ILIKE '%.downloadstring(%' OR "Process CommandLine" ILIKE '%.downloadfile(%' OR "Process CommandLine" ILIKE '%.downloaddata(%') AND ("Process CommandLine" ILIKE '%iex%' OR "Process CommandLine" ILIKE '%invoke-expression%')
Response: dispatch new event / create offense indexed by Source IP; annotate "Skopnix T1059.001".
FP-safety: All three conditions must hold (PowerShell binary, a download method, an execute verb); plain Invoke-WebRequest file downloads and encoded management scripts do not match.