{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/fileless-malware/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":["FIN7","Carbon Spider","Sangria Tempest"],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["high"],"_cs_tags":["fileless-malware","powershell","execution"],"_cs_type":"threat","_cs_vendors":[],"content_html":"\u003cp\u003eThreat actors, including groups like FIN7, frequently employ PowerShell download cradles to facilitate the delivery and execution of malicious code in memory. These techniques bypass traditional file-based antivirus solutions by fetching remote content - often second-stage backdoors or beacons - and piping it directly into the Invoke-Expression (IEX) cmdlet. These commands are often obfuscated to hinder signature-based detection. This method is a hallmark of initial access and secondary infection stages across various targeted campaigns, particularly against high-value infrastructure like Veeam backup servers. Defenders must monitor process command lines for the combination of download cmdlets and execution primitives to identify these potentially malicious memory-only execution chains.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker gains initial access or escalation, dropping a short PowerShell stubs.\u003c/li\u003e\n\u003cli\u003eThe stubs use cmdlets such as 'Invoke-WebRequest' or 'irm' to initiate a web request.\u003c/li\u003e\n\u003cli\u003eThe request targets an attacker-controlled URI to download a remote payload.\u003c/li\u003e\n\u003cli\u003eThe downloaded string or file content is passed via the pipeline to 'IEX' or 'Invoke-Expression'.\u003c/li\u003e\n\u003cli\u003eThe 'IEX' alias (including obfuscated variations like 'I\u003ccode\u003eE\u003c/code\u003eX') executes the payload content in memory.\u003c/li\u003e\n\u003cli\u003eThe payload, often an obfuscated script, initiates a C2 connection or performs credential harvesting.\u003c/li\u003e\n\u003cli\u003eFinal objective (exfiltration, ransomware deployment, or secondary persistence) is achieved in the context of the running PowerShell process.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful execution of these cradles allows for fileless malware deployment, enabling attackers to maintain persistence, escalate privileges, and exfiltrate data while minimizing their footprint on the target disk. Observed targets include enterprise infrastructure and backup systems.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eDeploy the Sigma rule below to detect the concatenation of download cmdlets and execution primitives.\u003c/li\u003e\n\u003cli\u003eBaseline your environment for legitimate PowerShell installers that may use similar syntax and add them to a strict allowlist.\u003c/li\u003e\n\u003cli\u003eEnable Enhanced PowerShell Logging (Script Block Logging) to capture the de-obfuscated content of these execution cradles.\u003c/li\u003e\n\u003cli\u003eMonitor for PowerShell instances originating from non-administrative contexts or uncommon parent processes.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-09-03T12:40:30Z","date_published":"2026-09-03T12:40:30Z","id":"https://feed.craftedsignal.io/briefs/2026-09-powershell-cradles/","summary":"This brief documents common PowerShell patterns used by threat actors, including FIN7, to download and execute arbitrary payloads directly into memory using download cradles.","title":"PowerShell Download and Execution Cradles","url":"https://feed.craftedsignal.io/briefs/2026-09-powershell-cradles/"}],"language":"en","title":"CraftedSignal Threat Feed - Fileless-Malware","version":"https://jsonfeed.org/version/1.1"}