Skip to content
skopnix
Detections · Rule
← Sigma detectionsSigma · Behaviour (ATT&CK technique)

PowerShell download cradle executed from the command line (T1059.001)

SIGhighconfidence 80/100generated 2026-10-18

powershell.exe / pwsh.exe whose command line both downloads (Net.WebClient DownloadString / DownloadFile / DownloadData) and executes (IEX / Invoke-Expression) — the classic in-memory loader. Observed for: APT-C-36, APT10, APT19, APT27, APT28, APT29 and 71 more.

ATT&CK
T1059.001 mitre ↗
Linked actors
APT-C-36 · APT10 · APT19 · APT27 · APT28 · APT29 · APT3 · APT32 · APT33 · APT35 · APT39 · APT40 · APT42 · APT5 · blackbyte · Blue Mockingbird · BRONZE HIGHLAND · BRONZE STARLIGHT · Chimera · Cobalt · Confucius · CopyKittens · DarkHydrus · DarkVishnya · DustSquad · Earth Kapre · Earth Lusca · ENERGETIC BEAR · FIN10 · FIN13 · FIN6 · FIN8 · Fox Kitten · GALLIUM · Gallmaker · Gamaredon Group · GOLD SOUTHFIELD · HAFNIUM · Inception Framework · INDRIK SPIDER · Kimsuky · LazyScripter · LYCEUM · Medusa Group · Molerats · MoustachedBouncer · MuddyWater · OilRig · play · Poseidon Group · QUILTED TIGER · RAZOR TIGER · SaintBear · Sandworm · Scattered Spider · Silence group · Stealth Falcon · Storm-0501 · Storm-1567 · TA2541 · TA459 · TA505 · TeamTNT · The Gorgon Group · Thrip · Tick · ToddyCat · Tonto Team · Tortoiseshell · Turla · UNC3886 · UNC4393 · Void Manticore · Volt Typhoon · Winter Vivern · WIRTE · WIZARD SPIDER
False positives
All three conditions must hold (PowerShell binary, a download method, an execute verb); plain Invoke-WebRequest file downloads and encoded management scripts do not match.

Sigma rule

skopnix-sigma-ttp-t1059-001-65605413.ymldownload .yml ↓
title: Skopnix - PowerShell download cradle executed from the command line (T1059.001)
id: b65cca45-f99d-50b3-b2f9-40ee0f340a19
status: experimental
description: 'powershell.exe / pwsh.exe whose command line both downloads (Net.WebClient DownloadString / DownloadFile / DownloadData) and executes (IEX / Invoke-Expression) — the classic in-memory loader. Observed for: APT-C-36, APT10, APT19, APT27, APT28, APT29 and 71 more.'
references:
  - https://attack.mitre.org/techniques/T1059/001/
  - https://skopnix.com/actors/apt-c-36
  - https://skopnix.com/actors/apt10
  - https://skopnix.com/actors/apt19
  - https://skopnix.com/actors/apt27
  - https://skopnix.com/actors/apt28
  - https://skopnix.com/actors/apt29
  - https://skopnix.com/actors/apt3
  - https://skopnix.com/actors/apt32
  - https://skopnix.com/actors/apt33
  - https://skopnix.com/actors/apt35
author: skopnix
date: '2026-10-18'
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - \powershell.exe
      - \pwsh.exe
  selection_download:
    CommandLine|contains:
      - .DownloadString(
      - .DownloadFile(
      - .DownloadData(
  selection_exec:
    CommandLine|contains:
      - IEX
      - Invoke-Expression
  condition: all of selection_*
falsepositives:
  - Installer one-liners (e.g. package-manager bootstrap scripts) run by administrators; baseline by URL and user
level: high

How to deploy on Sigma

  1. 1.Convert for your SIEM with sigma-cli / pySigma, e.g. sigma convert -t splunk -p sysmon rule.yml.
  2. 2.Run it as a hunt first: every rule ships as status experimental.
  3. 3.Promote to an alert once a week of results is clean on your data.

Check · The processing pipeline must map the logsource (firewall, dns, proxy, webserver, process_creation) to your field names.

References