Suspicious PowerShell Download - Powershell Script

Title: Suspicious PowerShell Download - Powershell Script
Status: test
Description:Detects suspicious PowerShell download command
References:
  -https://learn.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadstring?view=net-8.0
  -https://learn.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadfile?view=net-8.0
Author: Florian Roth (Nextron Systems)
Date: 2017-03-05
modified:2022-12-02
Tags:

• -'attack.execution'
• -'attack.t1059.001'

Logsource:

• product: windows
• category: ps_script
• definition: Requirements: Script Block Logging must be enabled

Detection:
  webclient:
    ScriptBlockText|contains: 'System.Net.WebClient'
  download:
    ScriptBlockText|contains:
      -'.DownloadFile('
      -'.DownloadFileAsync('
      -'.DownloadString('
      -'.DownloadStringAsync('

  condition:webclient and download
Falsepositives:
  -PowerShell scripts that download content from the Internet
Level: medium