Detectionmediumtest

Suspicious PowerShell Download - Powershell Script

Detects suspicious PowerShell download command

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Florian Roth (Nextron Systems)Created Sun Mar 05Updated Fri Dec 02403c2cc0-7f6b-4925-9423-bfa573bed7ebwindows

Log Source

WindowsPowerShell Script

ProductWindows← raw: windows

CategoryPowerShell Script← raw: ps_script

Definition

Requirements: Script Block Logging must be enabled

Detection Logic

detection:
    webclient:
        ScriptBlockText|contains: 'System.Net.WebClient'
    download:
        ScriptBlockText|contains:
            - '.DownloadFile('
            - '.DownloadFileAsync('
            - '.DownloadString('
            - '.DownloadStringAsync('
    condition: webclient and download