Windows PowerShell execution with download-related command line patterns

title: Windows PowerShell execution with download-related command line patterns
id: 9e07d713-d286-483c-a53c-79aaa277c6a3
related:
  - id: e6c54d94-498c-4562-a37c-b469d8e9a275
    type: derived
  - id: 8f70ac5f-1f6f-4f8e-b454-db19561216c5
    type: obsolete
  - id: 3b6ab547-8ec2-4991-b9d2-2b06702a48d7
    type: derived
status: test
description: This rule flags process creation events where PowerShell (powershell.exe, powershell_ise.exe, or pwsh.exe) is launched and its command line contains specific download-related constructs. Attackers often use PowerShell to fetch remote content or stage payloads, and the presence of these string fragments indicates automated download behavior. The detection relies on Windows process creation telemetry, matching the process image and command line substrings.
references:
  - https://blog.redteam.pl/2020/06/black-kingdom-ransomware.html
  - https://lab52.io/blog/winter-vivern-all-summer/
  - https://hatching.io/blog/powershell-analysis/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_download_patterns.yml
author: Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro, Huntrule Team
date: 2019-01-16
modified: 2025-10-20
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith:
        - \powershell_ise.exe
        - \powershell.exe
        - \pwsh.exe
    - OriginalFileName:
        - PowerShell_ISE.EXE
        - PowerShell.EXE
        - pwsh.dll
  selection_cli:
    CommandLine|contains|all:
      - new-object
      - net.webclient).
      - download
    CommandLine|contains:
      - string(
      - file(
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1