Windows PowerShell Downloading DLLs via Invoke-WebRequest or Invoke-RestMethod

Alerts on PowerShell using web request cmdlets to download an HTTP DLL to disk.

FreeUnreviewedSigmamediumv1

windows-powershell-downloading-dlls-via-invoke-webrequest-or-invoke-restmethod-0f0450f3

title: Windows PowerShell Downloading DLLs via Invoke-WebRequest or Invoke-RestMethod
id: 5c3dd74e-572b-4c70-9563-b688b02c801b
status: test
description: This rule flags Windows process creation where PowerShell command lines indicate downloading content over HTTP to a file ending in .dll using Invoke-WebRequest or Invoke-RestMethod. Attackers commonly use these cmdlets to retrieve and stage malicious DLLs for later execution, making this an important early indicator. Detection relies on process creation telemetry and matching PowerShell command line strings containing http, OutFile, and .dll alongside the relevant cmdlet aliases.
references:
  - https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_download_dll.yml
author: Florian Roth (Nextron Systems), Hieu Tran, Huntrule Team
date: 2023-03-13
modified: 2025-07-18
tags:
  - attack.command-and-control
  - attack.execution
  - attack.t1059.001
  - attack.t1105
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    CommandLine|contains:
      - "Invoke-RestMethod "
      - "Invoke-WebRequest "
      - "IRM "
      - "IWR "
    CommandLine|contains|all:
      - http
      - OutFile
      - .dll
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 0f0450f3-8b47-441e-a31b-15a91dc243e2
    type: derived

What it detects

This rule flags Windows process creation where PowerShell command lines indicate downloading content over HTTP to a file ending in .dll using Invoke-WebRequest or Invoke-RestMethod. Attackers commonly use these cmdlets to retrieve and stage malicious DLLs for later execution, making this an important early indicator. Detection relies on process creation telemetry and matching PowerShell command line strings containing http, OutFile, and .dll alongside the relevant cmdlet aliases.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.