Windows PowerShell Downloading DLLs via Invoke-WebRequest or Invoke-RestMethod

Alerts on PowerShell using web request cmdlets to download an HTTP DLL to disk.

FreeReviewedSigma · Medium · v1

Product: windows
Category: process_creation
Author: Florian Roth (Nextron Systems), Hieu Tran (SigmaHQ), DRL 1.1
Published: 2023-03-13
Updated: 2026-07-30

ATT&CK techniques

Execution → C2

Recon
Resource Dev
Initial Access
Execution
- T1059.001PowerShell
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
- T1105Ingress Tool Transfer
Exfiltration
Impact

What it detects

This rule flags Windows process creation where PowerShell command lines indicate downloading content over HTTP to a file ending in .dll using Invoke-WebRequest or Invoke-RestMethod. Attackers commonly use these cmdlets to retrieve and stage malicious DLLs for later execution, making this an important early indicator. Detection relies on process creation telemetry and matching PowerShell command line strings containing http, OutFile, and .dll alongside the relevant cmdlet aliases.

Reporting behind it

Related detections9 linkedT1059.001 — drag to rearrange

Suspicious PowerShell Download of Disguised Payload to ProgramData

Suspicious PowerShell WebClient Download of Executable Payload

Suspicious PowerShell Remote Script Execution via IEX DownloadString

Suspicious PowerShell Download Cradle to Blogspot (via process_creation)

Suspicious Hidden PowerShell WebClient DownloadFile Cradle

Suspicious PowerShell Download Cradle with Spoofed User-Agent via MSIX

Malicious PowerShell In-Memory Download Cradle via Script Block (via ps_script)

Suspicious node.exe Execution Spawned by PowerShell

Suspicious PowerShell Download Cradle via IEX and DownloadString (via process_creation)

Windows PowerShell Downloading DLLs via Invoke-WebRequest or Invoke-RestMethod

Pivot detection · T1059.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-powershell-downloading-dlls-via-invoke-webrequest-or-invoke-restmethod-0f0450f3

title: Windows PowerShell Downloading DLLs via Invoke-WebRequest or Invoke-RestMethod
id: 5c3dd74e-572b-4c70-9563-b688b02c801b
status: test
description: This rule flags Windows process creation where PowerShell command lines indicate downloading content over HTTP to a file ending in .dll using Invoke-WebRequest or Invoke-RestMethod. Attackers commonly use these cmdlets to retrieve and stage malicious DLLs for later execution, making this an important early indicator. Detection relies on process creation telemetry and matching PowerShell command line strings containing http, OutFile, and .dll alongside the relevant cmdlet aliases.
references:
  - https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_download_dll.yml
author: Florian Roth (Nextron Systems), Hieu Tran, Huntrule Team
date: 2023-03-13
modified: 2025-07-18
tags:
  - attack.command-and-control
  - attack.execution
  - attack.t1059.001
  - attack.t1105
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    CommandLine|contains:
      - "Invoke-RestMethod "
      - "Invoke-WebRequest "
      - "IRM "
      - "IWR "
    CommandLine|contains|all:
      - http
      - OutFile
      - .dll
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 0f0450f3-8b47-441e-a31b-15a91dc243e2
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL