Windows PowerShell Invoke-WebRequest Execution via Direct IP in Command Line

Alerts when PowerShell executes web-request aliases targeting direct IP URLs, indicating possible remote content access.

FreeReviewedSigma · Medium · v1

Product: windows
Category: process_creation
Author: Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2023-04-21
Updated: 2026-07-30

Analysis Detection

ATT&CK techniques

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
- T1105Ingress Tool Transfer
Exfiltration
Impact

What it detects

This rule flags Windows process creation events where PowerShell (powershell.exe, pwsh.exe, or PowerShell ISE) runs commands that include Invoke-WebRequest aliases and a direct IP address in the URL. Attackers often use direct IP targets to download or interact with remote content while avoiding domain-based detections. The detection relies on process creation telemetry, matching the PowerShell image name and command line substrings for Invoke-WebRequest-related aliases and IP-based URLs.

Reporting behind it

Related detections9 linkedT1105 — drag to rearrange

Suspicious File Download via CertUtil URLCache (via process_creation)

Suspicious PowerShell Download of Disguised Payload to ProgramData

Suspicious PowerShell WebClient Download of Executable Payload

Malicious JADEPUFFER Lockd Ransomware Payload Download

Malicious Second-Stage Loader Fetch of SLT Payload via Curl or Wget

Possible Remote Payload Download And Execution via Shell (via process_creation)

Suspicious EtherRAT Node.js Implant Background Execution via Shell (via process_creation)

Suspicious Certutil Download and Certificate Installation via Living-off-the-Land

Suspicious PowerShell Remote Script Execution via IEX DownloadString

Windows PowerShell Invoke-WebRequest Execution via Direct IP in Command Line

Pivot detection · T1105 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-powershell-invoke-webrequest-execution-via-direct-ip-in-command-line-1edff897

title: Windows PowerShell Invoke-WebRequest Execution via Direct IP in Command Line
id: 4ad9c5d6-9827-4d67-969e-2dceed9fb0f4
status: test
description: This rule flags Windows process creation events where PowerShell (powershell.exe, pwsh.exe, or PowerShell ISE) runs commands that include Invoke-WebRequest aliases and a direct IP address in the URL. Attackers often use direct IP targets to download or interact with remote content while avoiding domain-based detections. The detection relies on process creation telemetry, matching the PowerShell image name and command line substrings for Invoke-WebRequest-related aliases and IP-based URLs.
references:
  - https://www.huntress.com/blog/critical-vulnerabilities-in-papercut-print-management-software
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_invoke_webrequest_direct_ip.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-04-21
tags:
  - attack.command-and-control
  - attack.t1105
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith:
        - \powershell_ise.exe
        - \powershell.exe
        - \pwsh.exe
    - OriginalFileName:
        - powershell_ise.EXE
        - PowerShell.EXE
        - pwsh.dll
  selection_commands:
    CommandLine|contains:
      - "curl "
      - Invoke-RestMethod
      - Invoke-WebRequest
      - " irm "
      - "iwr "
      - "wget "
  selection_ip:
    CommandLine|contains:
      - ://1
      - ://2
      - ://3
      - ://4
      - ://5
      - ://6
      - ://7
      - ://8
      - ://9
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 1edff897-9146-48d2-9066-52e8d8f80a2f
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL