SigmaHQ/rules/windows/powershell/powershell_suspicious_download.yml

title: Suspicious PowerShell Download
status: experimental
description: Detects suspicious PowerShell download command
tags:
    - attack.execution
    - attack.t1086
author: Florian Roth
logsource:
    product: windows
    service: powershell
detection:
    keywords:
        - 'System.Net.WebClient).DownloadString('
        - 'system.net.webclient).downloadfile('
    condition: keywords
falsepositives:
    - PowerShell scripts that download content from the Internet
level: medium
More PowerShell rules 2017-03-05 14:01:51 +00:00			`title: Suspicious PowerShell Download`
			`status: experimental`
			`description: Detects suspicious PowerShell download command`
Tagged windows powershell, other and malware rules. 2018-07-24 08:56:41 +00:00			`tags:`
			`- attack.execution`
			`- attack.t1086`
More PowerShell rules 2017-03-05 14:01:51 +00:00			`author: Florian Roth`
			`logsource:`
Bugfix: PowerShell rules log source inconstency 2017-03-21 09:22:13 +00:00			`product: windows`
			`service: powershell`
More PowerShell rules 2017-03-05 14:01:51 +00:00			`detection:`
			`keywords:`
			`- 'System.Net.WebClient).DownloadString('`
			`- 'system.net.webclient).downloadfile('`
			`condition: keywords`
			`falsepositives:`
			`- PowerShell scripts that download content from the Internet`
			`level: medium`