rules/windows/powershell/powershell_suspicious_download.yml

title: Suspicious PowerShell Download
id: 65531a81-a694-4e31-ae04-f8ba5bc33759
status: experimental
description: Detects suspicious PowerShell download command
tags:
    - attack.execution
    - attack.t1086
author: Florian Roth
logsource:
    product: windows
    service: powershell
detection:
    keywords:
        Message:
            - '*System.Net.WebClient).DownloadString(*'
            - '*system.net.webclient).downloadfile(*'
    condition: keywords
falsepositives:
    - PowerShell scripts that download content from the Internet
level: medium
More PowerShell rules 2017-03-05 15:01:51 +01:00			`title: Suspicious PowerShell Download`
Added UUIDs to rules 2019-11-12 23:12:27 +01:00			`id: 65531a81-a694-4e31-ae04-f8ba5bc33759`
More PowerShell rules 2017-03-05 15:01:51 +01:00			`status: experimental`
			`description: Detects suspicious PowerShell download command`
Tagged windows powershell, other and malware rules. 2018-07-24 10:56:41 +02:00			`tags:`
			`- attack.execution`
			`- attack.t1086`
More PowerShell rules 2017-03-05 15:01:51 +01:00			`author: Florian Roth`
			`logsource:`
Bugfix: PowerShell rules log source inconstency 2017-03-21 10:22:13 +01:00			`product: windows`
			`service: powershell`
More PowerShell rules 2017-03-05 15:01:51 +01:00			`detection:`
			`keywords:`
fix: bound keywords to field in multiple PS rules 2019-10-29 19:53:18 +01:00			`Message:`
			`- 'System.Net.WebClient).DownloadString('`
			`- 'system.net.webclient).downloadfile('`
More PowerShell rules 2017-03-05 15:01:51 +01:00			`condition: keywords`
			`falsepositives:`
			`- PowerShell scripts that download content from the Internet`
			`level: medium`