Windows PowerShell CommandLine downloads and executes via WebClient with IEX or DownloadFile

Alerts on PowerShell command lines that use WebClient downloads combined with IEX or DownloadFile, typical of staged payload execution.

FreeUnreviewedSigmahighv1

windows-powershell-commandline-downloads-and-executes-via-webclient-with-iex-or--e6c54d94

title: Windows PowerShell CommandLine downloads and executes via WebClient with IEX or DownloadFile
id: 49b046b5-d784-4cb3-b146-90de2a199620
related:
  - id: 3b6ab547-8ec2-4991-b9d2-2b06702a48d7
    type: derived
  - id: e6c54d94-498c-4562-a37c-b469d8e9a275
    type: derived
status: test
description: This rule flags Windows process creation where the PowerShell command line includes suspicious download-and-execute patterns using WebClient combined with IEX and DownloadString/DownloadFile. Attackers commonly use these techniques to stage payloads by fetching code or files from remote locations and immediately executing them in memory or via a downloaded artifact. It relies on process_creation telemetry capturing the full PowerShell command line and matching specific substrings indicative of this behavior.
references:
  - https://gist.github.com/jivoi/c354eaaf3019352ce32522f916c03d70
  - https://www.trendmicro.com/en_us/research/22/j/lv-ransomware-exploits-proxyshell-in-attack.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_susp_download_patterns.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-02-28
modified: 2022-03-01
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - IEX ((New-Object Net.WebClient).DownloadString
      - IEX (New-Object Net.WebClient).DownloadString
      - IEX((New-Object Net.WebClient).DownloadString
      - IEX(New-Object Net.WebClient).DownloadString
      - " -command (New-Object System.Net.WebClient).DownloadFile("
      - " -c (New-Object System.Net.WebClient).DownloadFile("
  condition: selection
falsepositives:
  - Software installers that pull packages from remote systems and execute them
level: high
license: DRL-1.1

What it detects

This rule flags Windows process creation where the PowerShell command line includes suspicious download-and-execute patterns using WebClient combined with IEX and DownloadString/DownloadFile. Attackers commonly use these techniques to stage payloads by fetching code or files from remote locations and immediately executing them in memory or via a downloaded artifact. It relies on process_creation telemetry capturing the full PowerShell command line and matching specific substrings indicative of this behavior.

Known false positives

Software installers that pull packages from remote systems and execute them

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.