Usage Of Web Request Commands And Cmdlets

Title: Usage Of Web Request Commands And Cmdlets
Status: test
Description:Detects the use of various web request commands with commandline tools and Windows PowerShell cmdlets (including aliases) via CommandLine
References:
  -https://4sysops.com/archives/use-powershell-to-download-a-file-with-http-https-and-ftp/
  -https://blog.jourdant.me/post/3-ways-to-download-files-with-powershell
  -https://learn.microsoft.com/en-us/powershell/module/bitstransfer/add-bitsfile?view=windowsserver2019-ps
Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger
Date: 2019-10-24
modified:2025-10-20
Tags:

• -'attack.execution'
• -'attack.t1059.001'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    CommandLine|contains:
      -'[System.Net.WebRequest]::create'
      -'curl '
      -'Invoke-RestMethod'
      -'Invoke-WebRequest'
      -' irm '
      -'iwr '
      -'Resume-BitsTransfer'
      -'Start-BitsTransfer'
      -'wget '
      -'WinHttp.WinHttpRequest'

  condition:selection
Falsepositives:
  -Use of Get-Command and Get-Help modules to reference Invoke-WebRequest and Start-BitsTransfer.
Level: medium