PowerShell ScriptBlock Downloads via System.Net.WebClient

Alert on PowerShell ScriptBlock text that uses System.Net.WebClient to download files or strings from the Internet.

FreeUnreviewedSigmamediumv1

powershell-scriptblock-downloads-via-system-net-webclient-403c2cc0

title: PowerShell ScriptBlock Downloads via System.Net.WebClient
id: 9b9ac524-ce38-4009-8cff-ce2b56638877
related:
  - id: 65531a81-a694-4e31-ae04-f8ba5bc33759
    type: derived
  - id: 403c2cc0-7f6b-4925-9423-bfa573bed7eb
    type: derived
status: test
description: This rule flags PowerShell script content where ScriptBlock text includes use of System.Net.WebClient, along with download methods such as DownloadFile, DownloadFileAsync, DownloadString, or DownloadStringAsync. Attackers commonly use these patterns to retrieve remote code or payloads for execution, making outbound content retrieval within PowerShell a useful behavioral signal. It relies on PowerShell Script Block Logging telemetry that captures the script text used in the command.
references:
  - https://learn.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadstring?view=net-8.0
  - https://learn.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadfile?view=net-8.0
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_download.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-03-05
modified: 2022-12-02
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  webclient:
    ScriptBlockText|contains: System.Net.WebClient
  download:
    ScriptBlockText|contains:
      - .DownloadFile(
      - .DownloadFileAsync(
      - .DownloadString(
      - .DownloadStringAsync(
  condition: webclient and download
falsepositives:
  - PowerShell scripts that download content from the Internet
level: medium
license: DRL-1.1

What it detects

This rule flags PowerShell script content where ScriptBlock text includes use of System.Net.WebClient, along with download methods such as DownloadFile, DownloadFileAsync, DownloadString, or DownloadStringAsync. Attackers commonly use these patterns to retrieve remote code or payloads for execution, making outbound content retrieval within PowerShell a useful behavioral signal. It relies on PowerShell Script Block Logging telemetry that captures the script text used in the command.

Known false positives

PowerShell scripts that download content from the Internet

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.