Windows PowerShell Invoke-WebRequest Execution via Direct IP in Command Line

title: Windows PowerShell Invoke-WebRequest Execution via Direct IP in Command Line
id: 4ad9c5d6-9827-4d67-969e-2dceed9fb0f4
status: test
description: This rule flags Windows process creation events where PowerShell (powershell.exe, pwsh.exe, or PowerShell ISE) runs commands that include Invoke-WebRequest aliases and a direct IP address in the URL. Attackers often use direct IP targets to download or interact with remote content while avoiding domain-based detections. The detection relies on process creation telemetry, matching the PowerShell image name and command line substrings for Invoke-WebRequest-related aliases and IP-based URLs.
references:
  - https://www.huntress.com/blog/critical-vulnerabilities-in-papercut-print-management-software
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_invoke_webrequest_direct_ip.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-04-21
tags:
  - attack.command-and-control
  - attack.t1105
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith:
        - \powershell_ise.exe
        - \powershell.exe
        - \pwsh.exe
    - OriginalFileName:
        - powershell_ise.EXE
        - PowerShell.EXE
        - pwsh.dll
  selection_commands:
    CommandLine|contains:
      - "curl "
      - Invoke-RestMethod
      - Invoke-WebRequest
      - " irm "
      - "iwr "
      - "wget "
  selection_ip:
    CommandLine|contains:
      - ://1
      - ://2
      - ://3
      - ://4
      - ://5
      - ://6
      - ://7
      - ://8
      - ://9
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 1edff897-9146-48d2-9066-52e8d8f80a2f
    type: derived