PowerShell Web Download

Title: PowerShell Web Download
Status: test
Description:Detects suspicious ways to download files or content using PowerShell
References:
  -https://github.com/VirtualAlllocEx/Payload-Download-Cradles/blob/88e8eca34464a547c90d9140d70e9866dcbc6a12/Download-Cradles.cmd
Author: Florian Roth (Nextron Systems)
Date: 2022-03-24
modified:2023-01-05
Tags:

• -'attack.command-and-control'
• -'attack.execution'
• -'attack.t1059.001'
• -'attack.t1105'

Logsource:

• product: windows
• category: process_creation

Detection:
  selection:
    CommandLine|contains:
      -'.DownloadString('
      -'.DownloadFile('
      -'Invoke-WebRequest '
      -'iwr '

  condition:selection
Falsepositives:
  -Scripts or tools that download files
Level: medium