PowerShell Script With File Upload Capabilities

Title: PowerShell Script With File Upload Capabilities
Status: test
Description:Detects PowerShell scripts leveraging the "Invoke-WebRequest" cmdlet to send data via either "PUT" or "POST" method.
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1020/T1020.md
  -https://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html
  -https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/invoke-webrequest?view=powershell-7.4
Author: frack113
Date: 2022-01-07
modified:2025-07-18
Tags:

• -'attack.exfiltration'
• -'attack.t1020'

Logsource:

• product: windows
• category: ps_script
• definition: bade5735-5ab0-4aa7-a642-a11be0e40872

Detection:
  selection_cmdlet:
    ScriptBlockText|contains:
      -'Invoke-RestMethod'
      -'Invoke-WebRequest'
      -'irm '
      -'iwr '

  selection_flag:
    ScriptBlockText|contains:
      -'-Method "POST"'
      -'-Method "PUT"'
      -'-Method POST'
      -'-Method PUT'
      -'-Method 'POST''
      -'-Method 'PUT''

  condition:all of selection_*
Falsepositives:
  -Unknown
Level: low