rules/windows/process_creation/proc_creation_win_powershell_download.yml

title: PowerShell Download from URL
id: 3b6ab547-8ec2-4991-b9d2-2b06702a48d7
status: test
description: Detects a Powershell process that contains download commands in its command line string
author: Florian Roth, oscd.community, Jonhnathan Ribeiro
date: 2019/01/16
modified: 2021/11/27
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\powershell.exe'
    CommandLine|contains|all:
      - 'new-object'
      - 'net.webclient).'
      - 'download'
    CommandLine|contains:
      - 'string('
      - 'file('
  condition: selection
fields:
  - CommandLine
  - ParentCommandLine
falsepositives:
  - Unknown
level: medium
tags:
  - attack.execution
  - attack.t1059.001
Converted Sysmon/1 and Security/4688 to generic process creation rules 2019-01-16 23:36:31 +01:00			`title: PowerShell Download from URL`
Added UUIDs to rules 2019-11-12 23:12:27 +01:00			`id: 3b6ab547-8ec2-4991-b9d2-2b06702a48d7`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`status: test`
Converted Sysmon/1 and Security/4688 to generic process creation rules 2019-01-16 23:36:31 +01:00			`description: Detects a Powershell process that contains download commands in its command line string`
Update win_powershell_download.yml 2020-11-27 16:10:10 -03:00			`author: Florian Roth, oscd.community, Jonhnathan Ribeiro`
fix: fixed missing date fields in remaining files 2020-01-30 16:07:37 +01:00			`date: 2019/01/16`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`modified: 2021/11/27`
Converted Sysmon/1 and Security/4688 to generic process creation rules 2019-01-16 23:36:31 +01:00			`logsource:`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`category: process_creation`
			`product: windows`
Converted Sysmon/1 and Security/4688 to generic process creation rules 2019-01-16 23:36:31 +01:00			`detection:`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`selection:`
			`Image\|endswith: '\powershell.exe'`
			`CommandLine\|contains\|all:`
			`- 'new-object'`
			`- 'net.webclient).'`
			`- 'download'`
			`CommandLine\|contains:`
			`- 'string('`
			`- 'file('`
			`condition: selection`
Converted Sysmon/1 and Security/4688 to generic process creation rules 2019-01-16 23:36:31 +01:00			`fields:`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`- CommandLine`
			`- ParentCommandLine`
Converted Sysmon/1 and Security/4688 to generic process creation rules 2019-01-16 23:36:31 +01:00			`falsepositives:`
fix: unknown --> Unknown 2022-03-16 13:43:54 +01:00			`- Unknown`
Converted Sysmon/1 and Security/4688 to generic process creation rules 2019-01-16 23:36:31 +01:00			`level: medium`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`tags:`
			`- attack.execution`
			`- attack.t1059.001`