Windows PowerShell: WebRequest User-Agent Modification in ScriptBlockText

ATT&CK techniques

C2

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
- T1071.001Web Protocols
Exfiltration
Impact

What it detects

This rule looks for PowerShell script block content that uses common web request cmdlets (Invoke-WebRequest or Invoke-RestMethod) together with setting a custom -UserAgent parameter. Adversaries may alter the User-Agent header to better blend command-and-control traffic with legitimate web requests. It relies on Script Block Logging telemetry that captures ScriptBlockText containing the relevant cmdlet and -UserAgent usage patterns.

Reporting behind it

Related detections9 linkedT1071.001 — drag to rearrange

Malicious HarborWatch RAT Command and Control Beacon by User Agent (via proxy)

Suspicious UAT-10608 Credential Harvesting C2 Beacon via HTTP

Malicious BadIIS C2 Communication via lwxatisme User-Agent

Possible PS1Bot C2 Beacon With Drive Serial URI Pattern (via proxy)

Suspicious WarmCookie C2 Beacon With Fixed Firefox User-Agent

Malicious Renamed Python Interpreter Executing nvidia.py RAT

Malicious Self-Signed TLS Certificate With Exploit Subject via Zeek X509

Suspicious Network Connection From wabmig.exe (Turian Injection)

Suspicious wmicodegen.dll Sideload by inetinfo.exe (UAT-8099 Cobalt Strike)

Windows PowerShell: WebRequest User-Agent Modification in ScriptBlockText

Pivot detection · T1071.001 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

powershell-webrequest-user-agent-modification-d4488827

title: "Windows PowerShell: WebRequest User-Agent Modification in ScriptBlockText"
id: 64454a01-5066-4175-9d26-e04e728b3b83
status: test
description: This rule looks for PowerShell script block content that uses common web request cmdlets (Invoke-WebRequest or Invoke-RestMethod) together with setting a custom -UserAgent parameter. Adversaries may alter the User-Agent header to better blend command-and-control traffic with legitimate web requests. It relies on Script Block Logging telemetry that captures ScriptBlockText containing the relevant cmdlet and -UserAgent usage patterns.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1071.001/T1071.001.md#t1071001---web-protocols
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_invoke_webrequest_useragent.yml
author: frack113, Huntrule Team
date: 2022-01-23
modified: 2025-07-18
tags:
  - attack.command-and-control
  - attack.t1071.001
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection_webrequest:
    ScriptBlockText|contains:
      - Invoke-WebRequest
      - Invoke-RestMethod
      - " irm "
      - "iwr "
  selection_useragent:
    ScriptBlockText|contains: "-UserAgent "
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: d4488827-73af-4f8d-9244-7b7662ef046e
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL