huntrule

Suspicious File Download via PowerShell WebClient DownloadFile

PremiumReviewedSigma · Medium · v1
Product
windows
Category
process_creation
Author
HuntRule
Published
2026-09-28
Updated
2026-09-28
AnalysisDetection

ATT&CK techniques

Execution → C2

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects PowerShell downloading files with WebClient DownloadFile, used to retrieve an MSI and a malicious MSBuild XML in this campaign. This is a common ingress tool transfer method that, while occasionally used by administrators, frequently indicates payload staging.

Reporting behind it

Related detections9 linkedT1059.001 — drag to rearrange
Suspicious Encoded PowerShell DownloadString Execution
Suspicious PowerShell Download Cradle via Invoke-WebRequest Piped to iex (via process_creation)
Suspicious PowerShell Reverse-HTTP Shellcode Download via CVE-2024-4577 Exploitation
Suspicious ClickFix PowerShell Download Cradle via TAG-150 Tradecraft
Malicious PowerShell Download of FortiEndpoint Patch Masquerade via EKZ Stealer
Malicious PowerShell StreamReader WebRequest Download Cradle
Suspicious PowerShell Download Cradle via Net.WebClient DownloadFile
Malicious ClickFix Clipboard Command Execution via PowerShell
Suspicious PIKABOT PowerShell Download to Public Directory via Process Creation
Suspicious File Download via PowerShell WebClient DownloadFile
Pivot detection · T1059.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.