PowerShell Download Activity (PowerShell)

id: '17159.27778'
title: PowerShell Download Activity
description: 'This use case detects PowerShell commands used to download files or
  strings, indicating possible attempts to execute a script hosted on the internet.
  -- Threat Actor Association: Alloy Taurus/Gallium, APT28 (aka.Fancy Bear, Fighting
  Ursa, Forest Blizzard, Pawn Storm, TA422, STRONTIUM), APT29, APT40, FIN7, FIN8,
  FIN11, Gamaredon Group/Shuckworm, Turla (akaSecret Blizzard, KRYPTON, and UAC-0003),
  Sandworm Team - Software Association: ALPHV/Blackcat, Clop, LockBit, Quantum, Raspberry
  Robin, Remcos RAT, TargetCompany, Ursnif, Vice Society -- Atomics T1087.002 Test
  #15 Atomics T1135 Test #8 Atomics T1518 Test #4 Atomics T1518 Test #5 Atomics T1518
  Test #6'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
  "<EventID>4103<" OR TERM(EventCode=4104) OR "<EventID>4104<") ((TERM(Invoke-Expression)
  OR TERM(iex)) AND (TERM(Invoke-WebRequest) OR TERM(iwr))) OR ("New-Object" "Net.Webclient"
  "Download") | table _time, host, user, user, process | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- execution:command and scripting interpreter:powershell
- execution:command and scripting interpreter
- command-and-control:ingress tool transfer
technique_id:
- T1059.001
- T1059
- T1105
data_category:
- PowerShell logs
references:
- https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/invoke-expression?view=powershell-7.3
- https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/invoke-webrequest?view=powershell-7.3
- https://blog.talosintelligence.com/prometei-botnet-improves/
- https://blog.talosintelligence.com/lazarus-three-rats/