PowerShell ScriptBlock Web Request Commands and Cmdlets

Alerts when PowerShell script blocks reference web request and download cmdlets/commands, excluding a specific guest configuration path.

FreeUnreviewedSigmamediumv1

powershell-scriptblock-web-request-commands-and-cmdlets-1139d2e2

title: PowerShell ScriptBlock Web Request Commands and Cmdlets
id: 52f581d5-ace4-41fd-9253-81f7b2e9ddf2
related:
  - id: 9fc51a3c-81b3-4fa7-b35f-7c02cf10fd2d
    type: derived
  - id: 1139d2e2-84b1-4226-b445-354492eba8ba
    type: derived
status: test
description: This rule flags PowerShell Script Block Logging where scripts reference common web request mechanisms, including .NET WebRequest creation, REST invocation cmdlets, web download aliases, and BITS transfer commands. Such activity is commonly used to retrieve remote content and can indicate staging or payload retrieval behavior by an attacker. It relies on ScriptBlockText content matches in PowerShell script block telemetry, excluding script blocks under a specific Guest Configuration path.
references:
  - https://4sysops.com/archives/use-powershell-to-download-a-file-with-http-https-and-ftp/
  - https://blog.jourdant.me/post/3-ways-to-download-files-with-powershell
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_web_request_cmd_and_cmdlets.yml
author: James Pemberton / @4A616D6573, Huntrule Team
date: 2019-10-24
modified: 2025-10-20
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains:
      - "[System.Net.WebRequest]::create"
      - "curl "
      - Invoke-RestMethod
      - Invoke-WebRequest
      - " irm "
      - "iwr "
      - Resume-BitsTransfer
      - Start-BitsTransfer
      - "wget "
      - WinHttp.WinHttpRequest
  filter:
    Path|startswith: C:\Packages\Plugins\Microsoft.GuestConfiguration.ConfigurationforWindows\
  condition: selection and not filter
falsepositives:
  - Use of Get-Command and Get-Help modules to reference Invoke-WebRequest and Start-BitsTransfer.
level: medium
license: DRL-1.1

What it detects

This rule flags PowerShell Script Block Logging where scripts reference common web request mechanisms, including .NET WebRequest creation, REST invocation cmdlets, web download aliases, and BITS transfer commands. Such activity is commonly used to retrieve remote content and can indicate staging or payload retrieval behavior by an attacker. It relies on ScriptBlockText content matches in PowerShell script block telemetry, excluding script blocks under a specific Guest Configuration path.

Known false positives

Use of Get-Command and Get-Help modules to reference Invoke-WebRequest and Start-BitsTransfer.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.