PowerShell WebRequest User-Agent Modification

title: PowerShell WebRequest User-Agent Modification
id: 64454a01-5066-4175-9d26-e04e728b3b83
status: test
description: This rule flags PowerShell script block text that uses web request cmdlets and sets a custom -UserAgent parameter. Attackers can blend application-layer communications into normal web traffic to reduce filtering and increase stealth. The detection relies on Script Block Logging telemetry to match for Invoke-WebRequest/Invoke-RestMethod usage together with a -UserAgent setting in the script content.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1071.001/T1071.001.md#t1071001---web-protocols
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_invoke_webrequest_useragent.yml
author: frack113, Huntrule Team
date: 2022-01-23
modified: 2025-07-18
tags:
  - attack.command-and-control
  - attack.t1071.001
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection_webrequest:
    ScriptBlockText|contains:
      - Invoke-WebRequest
      - Invoke-RestMethod
      - " irm "
      - "iwr "
  selection_useragent:
    ScriptBlockText|contains: "-UserAgent "
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: d4488827-73af-4f8d-9244-7b7662ef046e
    type: derived