Suspicious PowerShell Download - PoshModule

Title: Suspicious PowerShell Download - PoshModule
Status: test
Description:Detects suspicious PowerShell download command
References:
  -https://learn.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadfile?view=net-8.0
  -https://learn.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadstring?view=net-8.0
Author: Florian Roth (Nextron Systems)
Date: 2017-03-05
modified:2023-01-20
Tags:

• -'attack.execution'
• -'attack.t1059.001'

Logsource:

• product: windows
• category: ps_module
• definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b

Detection:
  selection_webclient_:
    ContextInfo|contains: 'System.Net.WebClient'
  selection_function:
    ContextInfo|contains:
      -'.DownloadFile('
      -'.DownloadString('

  condition:all of selection_*
Falsepositives:
  -PowerShell scripts that download content from the Internet
Level: medium