Windows PowerShell: WebRequest User-Agent Modification in ScriptBlockText
Detects PowerShell scripts that make web requests and set a custom -UserAgent value.
- Product
- windows
- Category
- ps_script
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-01-23
- Updated
- 2026-07-31
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule looks for PowerShell script block content that uses common web request cmdlets (Invoke-WebRequest or Invoke-RestMethod) together with setting a custom -UserAgent parameter. Adversaries may alter the User-Agent header to better blend command-and-control traffic with legitimate web requests. It relies on Script Block Logging telemetry that captures ScriptBlockText containing the relevant cmdlet and -UserAgent usage patterns.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1071.001/T1071.001.md#t1071001---web-protocols
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_invoke_webrequest_useragent.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows PowerShell: WebRequest User-Agent Modification in ScriptBlockText"
id: 64454a01-5066-4175-9d26-e04e728b3b83
status: test
description: This rule looks for PowerShell script block content that uses common web request cmdlets (Invoke-WebRequest or Invoke-RestMethod) together with setting a custom -UserAgent parameter. Adversaries may alter the User-Agent header to better blend command-and-control traffic with legitimate web requests. It relies on Script Block Logging telemetry that captures ScriptBlockText containing the relevant cmdlet and -UserAgent usage patterns.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1071.001/T1071.001.md#t1071001---web-protocols
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_invoke_webrequest_useragent.yml
author: frack113, Huntrule Team
date: 2022-01-23
modified: 2025-07-18
tags:
- attack.command-and-control
- attack.t1071.001
logsource:
product: windows
category: ps_script
definition: "Requirements: Script Block Logging must be enabled"
detection:
selection_webrequest:
ScriptBlockText|contains:
- Invoke-WebRequest
- Invoke-RestMethod
- " irm "
- "iwr "
selection_useragent:
ScriptBlockText|contains: "-UserAgent "
condition: all of selection_*
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: d4488827-73af-4f8d-9244-7b7662ef046e
type: derived