Usage Of Web Request Commands And Cmdlets - ScriptBlock

Title: Usage Of Web Request Commands And Cmdlets - ScriptBlock
Status: test
Description:Detects the use of various web request commands with commandline tools and Windows PowerShell cmdlets (including aliases) via PowerShell scriptblock logs
References:
  -https://4sysops.com/archives/use-powershell-to-download-a-file-with-http-https-and-ftp/
  -https://blog.jourdant.me/post/3-ways-to-download-files-with-powershell
Author: James Pemberton / @4A616D6573
Date: 2019-10-24
modified:2025-10-20
Tags:

• -'attack.execution'
• -'attack.t1059.001'

Logsource:

• product: windows
• category: ps_script
• definition: Requirements: Script Block Logging must be enabled

Detection:
  selection:
    ScriptBlockText|contains:
      -'[System.Net.WebRequest]::create'
      -'curl '
      -'Invoke-RestMethod'
      -'Invoke-WebRequest'
      -' irm '
      -'iwr '
      -'Resume-BitsTransfer'
      -'Start-BitsTransfer'
      -'wget '
      -'WinHttp.WinHttpRequest'

  filter:
    Path|startswith: 'C:\Packages\Plugins\Microsoft.GuestConfiguration.ConfigurationforWindows\'
  condition:selection and not filter
Falsepositives:
  -Use of Get-Command and Get-Help modules to reference Invoke-WebRequest and Start-BitsTransfer.
Level: medium