Possible PowerShell Download Through Net.WebClient - PowerShell Classic (via ps_classic_start)

title: Possible PowerShell Download Through Net.WebClient - PowerShell Classic (via ps_classic_start)
id: b2afd359-8085-5395-815c-abe210ae3081
status: stable
description: This rule detects PowerShell download activity, via the .DownloadFile() or .DownloadString() methods of the Net.WebClient class. This method is frequently misused by adversaries to download additional payloads.
references:
    - https://attack.mitre.org/techniques/T1105/
    - https://attack.mitre.org/techniques/T1059/001/
    - https://www.trendmicro.com/en_us/research/22/j/lv-ransomware-exploits-proxyshell-in-attack.html
author: Huntrule Team
date: 2026-07-25
tags:
    - attack.execution
    - attack.command-and-control
    - attack.t1059.001
    - attack.t1105
logsource:
    product: windows
    category: ps_classic_start
detection:
    selection_webclient:
        Data|contains: 'Net.WebClient'
    selection_download:
        Data|contains:
            - '.DownloadFile('
            - '.DownloadString('
    condition: all of selection_*
falsepositives:
    - Unknown
level: low