PowerShell Download Via Net.WebClient - PowerShell Classic

Status: test
Severity: low
Log source: category ps_classic_start, product windows
Author: Florian Roth (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects PowerShell download activity, via the .DownloadFile() or .DownloadString() methods of the Net.WebClient class. This technique is often abused by attackers to download additional payloads.

Known false positives

This activity may be used by legitimate software, such as patch management tools or software updaters. Investigate any such activity and apply the necessary filter.

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1059.001` Command and Scripting Interpreter: PowerShell
Command & Control	`T1105` Ingress Tool Transfer

Telemetry coverage

Provider	Record / event type
PowerShell	Event ID 400

Rule body

title: PowerShell Download Via Net.WebClient - PowerShell Classic
id: 3236fcd0-b7e3-4433-b4f8-86ad61a9af2d
related:
    - id: 65531a81-a694-4e31-ae04-f8ba5bc33759
      type: derived
status: test
description: |
    Detects PowerShell download activity, via the .DownloadFile() or .DownloadString() methods of the Net.WebClient class.
    This technique is often abused by attackers to download additional payloads.
references:
    - https://www.trendmicro.com/en_us/research/22/j/lv-ransomware-exploits-proxyshell-in-attack.html
author: Florian Roth (Nextron Systems)
date: 2017-03-05
modified: 2026-04-28
tags:
    - attack.execution
    - attack.command-and-control
    - attack.t1059.001
    - attack.t1105
logsource:
    product: windows
    category: ps_classic_start
detection:
    selection_webclient:
        Data|contains: 'Net.WebClient'
    selection_download:
        Data|contains:
            - '.DownloadFile('
            - '.DownloadString('
    condition: all of selection_*
falsepositives:
    - This activity may be used by legitimate software, such as patch management tools or software updaters. Investigate any such activity and apply the necessary filter.
level: low

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_webclient`

selection_webclient:
    Data|contains: 'Net.WebClient'

Stage 2: `selection_download`

selection_download:
    Data|contains:
        - '.DownloadFile('
        - '.DownloadString('

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Data`	match	`.DownloadFile(` `.DownloadString(` `Net.WebClient`	`field:"Data" kind:match`