Windows PowerShell Invoke-WebRequest Download to Suspicious Paths
Alert when PowerShell uses Invoke-WebRequest/aliases with download flags and targets suspicious file locations.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-08-02
- Updated
- 2026-07-30
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule flags Windows process executions where a PowerShell-related binary (PowerShell ISE, PowerShell, or pwsh) runs a command that includes Invoke-WebRequest (or aliases like curl/wget/iwr) and output/download flags (-ur, -o). It also requires the command line to reference writing or directing content to commonly abused locations such as AppData, Desktop, Temp, Public, or paths under :\Windows. This behavior is significant because it can indicate scripted download-and-execute stages used to bring attacker-controlled payloads onto a host. It relies on process creation telemetry, including the image name and full command line.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows PowerShell Invoke-WebRequest Download to Suspicious Paths
id: c9b27984-a687-4f9d-9ff6-4f165907334e
related:
- id: e218595b-bbe7-4ee5-8a96-f32a24ad3468
type: derived
- id: 5e3cc4d8-3e68-43db-8656-eaaeefdec9cc
type: derived
status: test
description: This rule flags Windows process executions where a PowerShell-related binary (PowerShell ISE, PowerShell, or pwsh) runs a command that includes Invoke-WebRequest (or aliases like curl/wget/iwr) and output/download flags (-ur, -o). It also requires the command line to reference writing or directing content to commonly abused locations such as AppData, Desktop, Temp, Public, or paths under :\Windows. This behavior is significant because it can indicate scripted download-and-execute stages used to bring attacker-controlled payloads onto a host. It relies on process creation telemetry, including the image name and full command line.
references:
- https://www.sentinelone.com/blog/living-off-windows-defender-lockbit-ransomware-sideloads-cobalt-strike-through-microsoft-security-tool/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_invoke_webrequest_download.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-02
modified: 2025-07-18
tags:
- attack.command-and-control
- attack.t1105
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith:
- \powershell_ise.exe
- \powershell.exe
- \pwsh.exe
- OriginalFileName:
- powershell_ise.EXE
- PowerShell.EXE
- pwsh.dll
selection_commands:
CommandLine|contains:
- "curl "
- Invoke-WebRequest
- "iwr "
- "wget "
selection_flags:
CommandLine|contains:
- " -ur"
- " -o"
selection_susp_locations:
CommandLine|contains:
- \AppData\
- \Desktop\
- \Temp\
- \Users\Public\
- "%AppData%"
- "%Public%"
- "%Temp%"
- "%tmp%"
- :\Windows\
condition: all of selection_*
falsepositives:
- Unknown
level: high
license: DRL-1.1