Download cradle pattern

powershell_download_cradle

Uses the Net.WebClient download-cradle pattern (Windows) or a curl-into-shell pipeline (macOS/Linux) against a harmless connectivity endpoint. The fetched content is measured, never executed.

Severity medium how bad it would be if it were real

Expected outcome Something should notice

Platforms 3 macOS, Linux, Windows

Isolation subprocess runs in its own process, so a kill is a measurement

What it needs before it will run

runs in --safe
Observation only. It runs even in the inert mode, because it changes nothing and sends nothing.
sends traffic
Generates outbound traffic. --no-network suppresses it entirely.

Gates are cumulative and none of them is implied by another: see the three gates for why they are separate decisions.

ATT&CK techniques it exercises

MITRE ATT&CK techniques this test maps to.
Technique	Name	Tactic	Across public reports
T1059.001	PowerShell	Execution	coverage statistics
T1105	Ingress Tool Transfer	Command and Control	coverage statistics

How often anything notices

Not enough data: fewer than 3 public reports have run this test, so no rate is published for it. Groups below that threshold are withheld everywhere on the site — with one or two contributors an average is one organisation's result with a percent sign after it.

Other obfuscation and scripting tests

Other tests in the Obfuscation and scripting category.
Test	What it does	Severity
AMSI test sample execution amsi_test_string	Passes Microsoft's published AMSI test sample string to PowerShell. A working Antimalware Scan Interface provider must refuse the script, so a clean r…	medium
Character-obfuscated command execution cmd_obfuscated_exec	Executes a recon command hidden with caret escaping and environment-variable substitution on Windows, or quote splitting on macOS/Linux — the string-o…	medium
Base64-encoded PowerShell/shell execution powershell_encoded_command	Runs a base64-encoded command through powershell -EncodedCommand (Windows) or a base64 pipe into sh (macOS/Linux). The payload only prints a marker an…	medium

the whole catalogue this test in the list run it yourself

Catalogue generated from client 0.1.0. A test's behaviour can change between releases; this page describes the version named here.