Loading story…
Microsoft documents System.Net.WebClient.DownloadFile as a .NET method for retrieving files from a remote resource, while Splunk Threat Research highlights the same capability as a common indicator of malicious PowerShell activity when used from endpoint processes. The behavior is frequently associated with attackers and offensive frameworks downloading follow-on payloads that can lead to unauthorized code execution, data exfiltration, or wider compromise.
Splunk said its older analytic, Any Powershell DownloadFile, was removed from the content library and replaced by Windows File Download Via PowerShell with updated logic and grouping. The detection monitors process-execution telemetry from sources including Sysmon Event ID 1, Windows Security Event ID 4688, and CrowdStrike ProcessRollup2, maps to MITRE ATT&CK techniques T1059.001 and T1105, and may require tuning to reduce false positives based on parent process or command-line context.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
Splunk marked the "Any Powershell DownloadFile" analytic as removed from its content library and stated it is no longer maintained or supported. Splunk said it was replaced by a newer detection, "Windows File Download Via PowerShell," with improved logic and grouping, and listed the removal in version 5.12.0.
Splunk Threat Research published a TTP detection named "Any Powershell DownloadFile" to identify PowerShell use of the DownloadFile method via endpoint process execution telemetry. The detection was authored by Michael Haag and associated with Splunk Enterprise Security.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security reporting and vendor guidance highlight continued abuse of PowerShell's **`DownloadString`** capability to retrieve and execute remote payloads, a technique repeatedly seen in real-world intrusions. Microsoft documents the .NET `System.Net.WebClient.DownloadString` method as a way to fetch remote content, while Splunk previously published a detection analytic for PowerShell processes invoking `DownloadString`, warning that the behavior can enable arbitrary code download, execution, unauthorized access, and data exfiltration. The detection mapped the activity to **MITRE ATT&CK** techniques `T1059.001` and `T1105` before being replaced with broader file-download coverage. Case studies cited in the references show the technique appearing in multi-stage attacks involving commodity malware and post-exploitation frameworks. Malwarebytes documented the **LazyScripter** actor using PowerShell-heavy tradecraft in campaigns tied to tools including **Empire** and **Double RAT**, while DFIR reporting described an intrusion chain in which an **IcedID** infection escalated into **Nokoyawa ransomware** deployment. Together, the references show `DownloadString` remaining a common execution and payload-delivery mechanism across malware operations and hands-on-keyboard ransomware activity.
Aug 12, 2026
Security researchers highlighted continued abuse of the Windows utility **`certutil.exe`** as a living-off-the-land tool for downloading malicious files from remote locations. The activity centers on use of the `-urlcache` and `-f` arguments, which allow attackers to retrieve payloads while blending into legitimate system activity, even though `certutil.exe` is intended for certificate management rather than file transfer. Splunk published detection guidance for identifying this behavior in Windows process and EDR telemetry, specifically looking for command-line patterns associated with remote downloads and payload staging. The analytic was later deprecated and replaced by **"Windows File Download Via CertUtil"**, but the underlying risk remains the same: successful abuse of `certutil.exe` can enable malware delivery, follow-on execution, system compromise, and unauthorized access, with defenders advised to tune detections using parent-child process relationships and related network activity.
Aug 12, 2026
Attackers distributed malicious Windows shortcut (`.LNK`) files disguised as privacy consent forms and other work-related documents, tricking users into launching obfuscated PowerShell that fetched additional payloads from external infrastructure. Reporting indicates GitHub was used as a covert stage in the infection chain, helping operators blend malicious downloads and command retrieval into legitimate web traffic while keeping much of the activity fileless and in memory. Once executed, the malware created downloader and loader scripts, established persistence through Windows Task Scheduler, opened decoy documents to reduce suspicion, and deleted the original shortcut to limit forensic artifacts. Observed follow-on payloads included an information stealer and a backdoor loader that decrypted and loaded malware into memory; the theft activity gathered host, security product, network, IP, drive, file, and process data, with behavior resembling prior **Kimsuky**-linked operations.
Jun 29, 2026