huntrule

Suspicious PowerShell WebClient DownloadFile of Archive Payload (UAT-7237)

PremiumReviewedSigma · Medium · v1
Product
windows
Category
process_creation
Author
HuntRule
Published
2026-09-11
Updated
2026-09-11
AnalysisDetection

ATT&CK techniques

Execution

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects PowerShell using the System.Net.WebClient DownloadFile method to retrieve a remote archive payload. UAT-7237 uses this technique to stage tooling including SoftEther VPN packaged as a RAR archive for persistence. Scripted downloads of archives via WebClient are a common malware staging behavior.

Reporting behind it

Related detections9 linkedT1059.001 — drag to rearrange
Suspicious SharePoint Worker Process Spawning Command Interpreter via ToolShell
Malicious Emmenhtal JavaScript Loader Spawning Encoded PowerShell
Suspicious Python Interpreter Launching Encoded PowerShell via subprocess
Suspicious PowerShell Download of lib.zip Archive
Suspicious PowerShell Remote Payload Download via IEX DownloadString
Malicious PowerShell Spawned by PHP CGI Process
Malicious Shadow Copy Deletion Via WMI
Suspicious Script Host Spawning PowerShell With Bypass And Hidden Execution
Suspicious PS1Bot PowerShell Payload Written to ProgramData (via file_event)
Suspicious PowerShell WebClient DownloadFile of Archive Payload (UAT-7237)
Pivot detection · T1059.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.