PowerShell ScriptBlock WebClient Download Calls
Alert on PowerShell ScriptBlock text that uses System.Net.WebClient to download files or strings from the Internet.
- Product
- windows
- Category
- ps_script
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2017-03-05
- Updated
- 2026-07-31
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags PowerShell activity where a ScriptBlock contains references to System.Net.WebClient and download-related method calls such as DownloadFile, DownloadFileAsync, DownloadString, or DownloadStringAsync. Attackers commonly use these .NET WebClient methods to pull additional code or payload content into a PowerShell session. The detection relies on Script Block Logging telemetry that includes the ScriptBlockText content.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadstring?view=net-8.0
- learn.microsoft.comhttps://learn.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadfile?view=net-8.0
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_download.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: PowerShell ScriptBlock WebClient Download Calls
id: 9b9ac524-ce38-4009-8cff-ce2b56638877
related:
- id: 65531a81-a694-4e31-ae04-f8ba5bc33759
type: derived
- id: 403c2cc0-7f6b-4925-9423-bfa573bed7eb
type: derived
status: test
description: This rule flags PowerShell activity where a ScriptBlock contains references to System.Net.WebClient and download-related method calls such as DownloadFile, DownloadFileAsync, DownloadString, or DownloadStringAsync. Attackers commonly use these .NET WebClient methods to pull additional code or payload content into a PowerShell session. The detection relies on Script Block Logging telemetry that includes the ScriptBlockText content.
references:
- https://learn.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadstring?view=net-8.0
- https://learn.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadfile?view=net-8.0
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_download.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-03-05
modified: 2022-12-02
tags:
- attack.execution
- attack.t1059.001
logsource:
product: windows
category: ps_script
definition: "Requirements: Script Block Logging must be enabled"
detection:
webclient:
ScriptBlockText|contains: System.Net.WebClient
download:
ScriptBlockText|contains:
- .DownloadFile(
- .DownloadFileAsync(
- .DownloadString(
- .DownloadStringAsync(
condition: webclient and download
falsepositives:
- PowerShell scripts that download content from the Internet
level: medium
license: DRL-1.1