Windows PowerShell ScriptBlock Web Request Cmdlets and Command-Line Tools
Alerts when PowerShell script blocks reference web request and download cmdlets/commands, excluding a specific guest configuration path.
- Product
- windows
- Category
- ps_script
- Author
- James Pemberton / @4A616D6573 (SigmaHQ), DRL 1.1
- Published
- 2019-10-24
- Updated
- 2026-07-31
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags PowerShell script block activity that invokes common web request mechanisms, including specific .NET WebRequest creation and cmdlets/aliases such as Invoke-RestMethod, Invoke-WebRequest, iwr/irm, and bits transfer commands. Attackers often use these functions to download or retrieve resources over HTTP/HTTPS or other protocols, making this activity a useful indicator of suspicious execution. It relies on PowerShell Script Block Logging telemetry containing matching command strings, with an exclusion for Guest Configuration plugin paths.
Reporting behind it
- 4sysops.comhttps://4sysops.com/archives/use-powershell-to-download-a-file-with-http-https-and-ftp/
- blog.jourdant.mehttps://blog.jourdant.me/post/3-ways-to-download-files-with-powershell
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_web_request_cmd_and_cmdlets.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows PowerShell ScriptBlock Web Request Cmdlets and Command-Line Tools
id: 52f581d5-ace4-41fd-9253-81f7b2e9ddf2
related:
- id: 9fc51a3c-81b3-4fa7-b35f-7c02cf10fd2d
type: derived
- id: 1139d2e2-84b1-4226-b445-354492eba8ba
type: derived
status: test
description: This rule flags PowerShell script block activity that invokes common web request mechanisms, including specific .NET WebRequest creation and cmdlets/aliases such as Invoke-RestMethod, Invoke-WebRequest, iwr/irm, and bits transfer commands. Attackers often use these functions to download or retrieve resources over HTTP/HTTPS or other protocols, making this activity a useful indicator of suspicious execution. It relies on PowerShell Script Block Logging telemetry containing matching command strings, with an exclusion for Guest Configuration plugin paths.
references:
- https://4sysops.com/archives/use-powershell-to-download-a-file-with-http-https-and-ftp/
- https://blog.jourdant.me/post/3-ways-to-download-files-with-powershell
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_web_request_cmd_and_cmdlets.yml
author: James Pemberton / @4A616D6573, Huntrule Team
date: 2019-10-24
modified: 2025-10-20
tags:
- attack.execution
- attack.t1059.001
logsource:
product: windows
category: ps_script
definition: "Requirements: Script Block Logging must be enabled"
detection:
selection:
ScriptBlockText|contains:
- "[System.Net.WebRequest]::create"
- "curl "
- Invoke-RestMethod
- Invoke-WebRequest
- " irm "
- "iwr "
- Resume-BitsTransfer
- Start-BitsTransfer
- "wget "
- WinHttp.WinHttpRequest
filter:
Path|startswith: C:\Packages\Plugins\Microsoft.GuestConfiguration.ConfigurationforWindows\
condition: selection and not filter
falsepositives:
- Use of Get-Command and Get-Help modules to reference Invoke-WebRequest and Start-BitsTransfer.
level: medium
license: DRL-1.1