Windows PowerShell Invoke-WebRequest Execution via Direct IP in Command Line
Alerts when PowerShell executes web-request aliases targeting direct IP URLs, indicating possible remote content access.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-04-21
- Updated
- 2026-07-30
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule flags Windows process creation events where PowerShell (powershell.exe, pwsh.exe, or PowerShell ISE) runs commands that include Invoke-WebRequest aliases and a direct IP address in the URL. Attackers often use direct IP targets to download or interact with remote content while avoiding domain-based detections. The detection relies on process creation telemetry, matching the PowerShell image name and command line substrings for Invoke-WebRequest-related aliases and IP-based URLs.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows PowerShell Invoke-WebRequest Execution via Direct IP in Command Line
id: 4ad9c5d6-9827-4d67-969e-2dceed9fb0f4
status: test
description: This rule flags Windows process creation events where PowerShell (powershell.exe, pwsh.exe, or PowerShell ISE) runs commands that include Invoke-WebRequest aliases and a direct IP address in the URL. Attackers often use direct IP targets to download or interact with remote content while avoiding domain-based detections. The detection relies on process creation telemetry, matching the PowerShell image name and command line substrings for Invoke-WebRequest-related aliases and IP-based URLs.
references:
- https://www.huntress.com/blog/critical-vulnerabilities-in-papercut-print-management-software
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_invoke_webrequest_direct_ip.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-04-21
tags:
- attack.command-and-control
- attack.t1105
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith:
- \powershell_ise.exe
- \powershell.exe
- \pwsh.exe
- OriginalFileName:
- powershell_ise.EXE
- PowerShell.EXE
- pwsh.dll
selection_commands:
CommandLine|contains:
- "curl "
- Invoke-RestMethod
- Invoke-WebRequest
- " irm "
- "iwr "
- "wget "
selection_ip:
CommandLine|contains:
- ://1
- ://2
- ://3
- ://4
- ://5
- ://6
- ://7
- ://8
- ://9
condition: all of selection_*
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 1edff897-9146-48d2-9066-52e8d8f80a2f
type: derived