PowerShell Classic: Net.WebClient download via DownloadFile/DownloadString

Flags PowerShell Classic commands using Net.WebClient to download content via DownloadFile or DownloadString.

FreeUnreviewedSigmalowv1

powershell-classic-net-webclient-download-via-downloadfile-downloadstring-3236fcd0

title: "PowerShell Classic: Net.WebClient download via DownloadFile/DownloadString"
id: 5439adb1-64fc-4ba6-86eb-df57032965df
related:
  - id: 65531a81-a694-4e31-ae04-f8ba5bc33759
    type: derived
  - id: 3236fcd0-b7e3-4433-b4f8-86ad61a9af2d
    type: derived
status: test
description: This rule identifies PowerShell Classic activity where the command text includes the Net.WebClient class along with .DownloadFile() or .DownloadString(). Attackers commonly use these methods to retrieve additional payloads or stage content during command-and-control. Telemetry relies on PowerShell script/start logs capturing the Data field containing the specified class and method strings.
references:
  - https://www.trendmicro.com/en_us/research/22/j/lv-ransomware-exploits-proxyshell-in-attack.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_classic/posh_pc_download_via_webclient.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-03-05
modified: 2026-04-28
tags:
  - attack.execution
  - attack.command-and-control
  - attack.t1059.001
  - attack.t1105
logsource:
  product: windows
  category: ps_classic_start
detection:
  selection_webclient:
    Data|contains: Net.WebClient
  selection_download:
    Data|contains:
      - .DownloadFile(
      - .DownloadString(
  condition: all of selection_*
falsepositives:
  - This activity may be used by legitimate software, such as patch management tools or software updaters. Investigate any such activity and apply the necessary filter.
level: low
license: DRL-1.1

What it detects

This rule identifies PowerShell Classic activity where the command text includes the Net.WebClient class along with .DownloadFile() or .DownloadString(). Attackers commonly use these methods to retrieve additional payloads or stage content during command-and-control. Telemetry relies on PowerShell script/start logs capturing the Data field containing the specified class and method strings.

Known false positives

This activity may be used by legitimate software, such as patch management tools or software updaters. Investigate any such activity and apply the necessary filter.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.