Potential DLL File Download Via PowerShell Invoke-WebRequest

Title: Potential DLL File Download Via PowerShell Invoke-WebRequest
Status: test
Description:Detects potential DLL files being downloaded using the PowerShell Invoke-WebRequest or Invoke-RestMethod cmdlets.
References:
  -https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
Author: Florian Roth (Nextron Systems), Hieu Tran
Date: 2023-03-13
modified:2025-07-18
Tags:

• -'attack.command-and-control'
• -'attack.execution'
• -'attack.t1059.001'
• -'attack.t1105'

Logsource:

• product: windows
• category: process_creation

Detection:
  selection:
    CommandLine|contains:
      -'Invoke-RestMethod '
      -'Invoke-WebRequest '
      -'IRM '
      -'IWR '

    CommandLine|contains|all:
      -'http'
      -'OutFile'
      -'.dll'

  condition:selection
Falsepositives:
  -Unknown
Level: medium