Suspicious Change User Agents with WebRequest (via ps_script)

title: Suspicious Change User Agents with WebRequest (via ps_script)
id: 262c7187-1583-5ccb-a5eb-7a94124bec8e
status: stable
description: This rule detects threat actors may communicate using application layer protocols linked with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and frequently the results of those commands, will be embedded within the protocol traffic between the client and server.
references:
    - https://attack.mitre.org/techniques/T1071/001/
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1071.001/T1071.001.md#t1071001---web-protocols
author: Huntrule Team
date: 2026-04-09
tags:
    - attack.command-and-control
    - attack.t1071.001
logsource:
    product: windows
    category: ps_script
    definition: 'Requirements: Script Block Logging must be enabled'
detection:
    selection_webrequest:
        ScriptBlockText|contains:
            - 'Invoke-WebRequest'
            - 'Invoke-RestMethod'
            - ' irm '
            - 'iwr '
    selection_useragent:
        ScriptBlockText|contains: '-UserAgent '
    condition: all of selection_*
falsepositives:
    - Unknown
level: medium