huntrule

Windows PowerShell Downloading DLLs via Invoke-WebRequest or Invoke-RestMethod

Alerts on PowerShell using web request cmdlets to download an HTTP DLL to disk.

FreeReviewedSigma · Medium · v1
Product
windows
Category
process_creation
Author
Florian Roth (Nextron Systems), Hieu Tran (SigmaHQ), DRL 1.1
Published
2023-03-13
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Execution → C2

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Windows process creation where PowerShell command lines indicate downloading content over HTTP to a file ending in .dll using Invoke-WebRequest or Invoke-RestMethod. Attackers commonly use these cmdlets to retrieve and stage malicious DLLs for later execution, making this an important early indicator. Detection relies on process creation telemetry and matching PowerShell command line strings containing http, OutFile, and .dll alongside the relevant cmdlet aliases.

Reporting behind it

Related detections9 linkedT1059.001 — drag to rearrange
Suspicious PowerShell Download Cradle via ClickFix Fake CAPTCHA (via process_creation)
Suspicious PowerShell Download of lib.zip Archive
Malicious ActiveMQ Exploitation Java Spawning PowerShell Downloader (via process_creation)
Malicious In-Memory Payload Execution via PowerShell DownloadString (via process_creation)
Suspicious Remote Script Download and Execution via iwr Piped to iex
Suspicious PowerShell Invoke-WebRequest Download of Executable Payload
Suspicious Hidden PowerShell Download and Archive Expansion
Malicious PowerShell IEX DownloadString One-Liner
Malicious Cloud Atlas PowerShell Download Cradle via IEX WebClient (via process_creation)
Windows PowerShell Downloading DLLs via Invoke-WebRequest or Invoke-RestMethod
Pivot detection · T1059.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.