Detectionmediumtest

Usage Of Web Request Commands And Cmdlets

Detects the use of various web request commands with commandline tools and Windows PowerShell cmdlets (including aliases) via CommandLine

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
James Pemberton, Endgame, JHasenbusch, oscd.community, Austin SongerCreated Thu Oct 24Updated Mon Oct 209fc51a3c-81b3-4fa7-b35f-7c02cf10fd2dwindows
Log Source
WindowsProcess Creation
ProductWindows← raw: windows
CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic
Detection Logic1 selector
detection:
    selection:
        CommandLine|contains:
            - '[System.Net.WebRequest]::create'
            - 'curl '
            - 'Invoke-RestMethod'
            - 'Invoke-WebRequest'
            - ' irm ' # Space before and after to avoid false positives with 'irm' as a substring
            - 'iwr '
            # - 'Net.WebClient' # There are various other rules that cover this, so it is commented out
            - 'Resume-BitsTransfer'
            - 'Start-BitsTransfer'
            - 'wget '
            - 'WinHttp.WinHttpRequest'
    condition: selection
False Positives

Use of Get-Command and Get-Help modules to reference Invoke-WebRequest and Start-BitsTransfer.

MITRE ATT&CK
Rule Metadata
Rule ID
9fc51a3c-81b3-4fa7-b35f-7c02cf10fd2d
Status
test
Level
medium
Type
Detection
Created
Thu Oct 24
Modified
Mon Oct 20
Path
rules/windows/process_creation/proc_creation_win_susp_web_request_cmd_and_cmdlets.yml
Raw Tags
attack.executionattack.t1059.001
View on GitHub