PowerShell Download Pattern
Detects a Powershell process that contains download commands in its command line string
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.
detection:
selection_img:
- Image|endswith:
- '\powershell_ise.exe'
- '\powershell.exe'
- '\pwsh.exe'
- OriginalFileName:
- 'PowerShell_ISE.EXE'
- 'PowerShell.EXE'
- 'pwsh.dll'
selection_cli:
CommandLine|contains|all:
- 'new-object'
- 'net.webclient).'
- 'download'
CommandLine|contains:
- 'string('
- 'file('
condition: all of selection_*False positive likelihood has not been assessed. Additional context may be needed during triage.
Tactics
Sub-techniques
Suspicious PowerShell Download and Execute Pattern
Detects suspicious PowerShell download patterns that are often used in malicious scripts, stagers or downloaders (make sure that your backend applies the strings case-insensitive)
This rule was derived from the related rule - both detect similar activity with different scope.
8f70ac5f-1f6f-4f8e-b454-db19561216c5