PowerShell DownloadFile_DownloadString (Windows Event Log)

id: '29435.53027'
title: PowerShell DownloadFile_DownloadString
description: Adversaries have the capability to move tools or files from an external
  system into a compromised environment. This involves copying tools or files from
  an external system controlled by the adversary to the victim network through the
  command and control channel. This use case detects PowerShell commands related to
  file downloads using DownloadFile and DownloadString methods. Executions involving
  Invoke-WebRequest and Invoke-Expression have been excluded as they are covered by
  other use cases.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) ("downloadfile" OR "downloadstring") "System.Net.WebClient"
  NOT ("Invoke-WebRequest" OR "Invoke-Expression") | regex process="(?i)System\.Net\.WebClient.+\.Download(file|string)"|
  regex process!="(?i)(^|\s|\;|\|)(iex|iwr)(\s|\;|\|)"| table _time, host, user, process,
  process_name, parent_process_name | bin span=1s | stats values(*) as * by _time,
  host '
techniques:
- execution:command and scripting interpreter:powershell
- execution:command and scripting interpreter
- command-and-control:ingress tool transfer
technique_id:
- T1059.001
- T1059
- T1105
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://blog.talosintelligence.com/lazarus-three-rats/
- https://blog.talosintelligence.com/prometei-botnet-improves/