order powershell_script

2021-10-09 10:30:36 +02:00
parent 77749510b7
commit 5c68c42058
39 changed files with 2 additions and 1 deletions
@@ -0,0 +1,35 @@
+title: Windows PowerShell Web Request
+id: 1139d2e2-84b1-4226-b445-354492eba8ba
+related:
+    - id: 9fc51a3c-81b3-4fa7-b35f-7c02cf10fd2d
+      type: derived
+status: experimental
+description: Detects the use of various web request methods (including aliases) via Windows PowerShell command
+references:
+    - https://4sysops.com/archives/use-powershell-to-download-a-file-with-http-https-and-ftp/
+    - https://blog.jourdant.me/post/3-ways-to-download-files-with-powershell
+author: James Pemberton / @4A616D6573
+date: 2019/10/24
+modified: 2021/09/21
+tags:
+    - attack.execution
+    - attack.t1059.001
+    - attack.t1086  #an old one
+logsource:
+    product: windows
+    service: powershell
+    definition: 'Script block logging must be enabled'
+detection:
+    selection:
+        EventID: 4104
+        ScriptBlockText|contains:
+            - 'Invoke-WebRequest'
+            - 'iwr '
+            - 'wget '
+            - 'curl '
+            - 'Net.WebClient'
+            - 'Start-BitsTransfer'
+    condition: selection
+falsepositives:
+    - Use of Get-Command and Get-Help modules to reference Invoke-WebRequest and Start-BitsTransfer.
+level: medium