Suspicious Invoke-WebRequest Execution With DirectIP

Title: Suspicious Invoke-WebRequest Execution With DirectIP
Status: test
Description:Detects calls to PowerShell with Invoke-WebRequest cmdlet using direct IP access
References:
  -https://www.huntress.com/blog/critical-vulnerabilities-in-papercut-print-management-software
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-04-21
modified:None
Tags:

• -'attack.command-and-control'
• -'attack.t1105'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
    - Image|endswith:
      - '\powershell_ise.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
    - OriginalFileName:
      - 'powershell_ise.EXE'
      - 'PowerShell.EXE'
      - 'pwsh.dll'
  selection_commands:
    CommandLine|contains:
      -'curl '
      -'Invoke-RestMethod'
      -'Invoke-WebRequest'
      -' irm '
      -'iwr '
      -'wget '

  selection_ip:
    CommandLine|contains:
      -'://1'
      -'://2'
      -'://3'
      -'://4'
      -'://5'
      -'://6'
      -'://7'
      -'://8'
      -'://9'

  condition:all of selection_*
Falsepositives:
  -Unknown
Level: medium