Suspicious PowerShell Download - PoshModule

Status: test
Severity: medium
Log source: category ps_module, product windows
Author: Florian Roth (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects suspicious PowerShell download command

Known false positives

PowerShell scripts that download content from the Internet

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1059.001` Command and Scripting Interpreter: PowerShell

Telemetry coverage

Provider	Record / event type
PowerShell	Event ID 4103: Payload Context: ContextInfo User Data: UserData.

Rule body

title: Suspicious PowerShell Download - PoshModule
id: de41232e-12e8-49fa-86bc-c05c7e722df9
related:
    - id: 65531a81-a694-4e31-ae04-f8ba5bc33759
      type: derived
status: test
description: Detects suspicious PowerShell download command
references:
    - https://learn.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadfile?view=net-8.0
    - https://learn.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadstring?view=net-8.0
author: Florian Roth (Nextron Systems)
date: 2017-03-05
modified: 2023-01-20
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    product: windows
    category: ps_module
    definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b
detection:
    selection_webclient_:
        ContextInfo|contains: 'System.Net.WebClient'
    selection_function:
        ContextInfo|contains:
            - '.DownloadFile('
            - '.DownloadString('
    condition: all of selection_*
falsepositives:
    - PowerShell scripts that download content from the Internet
level: medium

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_webclient_`

selection_webclient_:
    ContextInfo|contains: 'System.Net.WebClient'

Stage 2: `selection_function`

selection_function:
    ContextInfo|contains:
        - '.DownloadFile('
        - '.DownloadString('

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ContextInfo`	match	`.DownloadFile(` `.DownloadString(` `System.Net.WebClient` corpus 2 (sigma 2)	`field:"ContextInfo" kind:match`

Suspicious PowerShell Download - PoshModule

Known false positives

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection_webclient_

Stage 2: selection_function

Indicators

Stage 0: `condition`

Stage 1: `selection_webclient_`

Stage 2: `selection_function`