Windows PowerShell Module Activity: Suspicious System.Net.WebClient DownloadFile/DownloadString

Alerts on PowerShell module activity referencing System.Net.WebClient with DownloadFile/DownloadString calls to fetch remote content.

FreeUnreviewedSigmamediumv1

windows-powershell-module-activity-suspicious-system-net-webclient-downloadfile--de41232e

title: "Windows PowerShell Module Activity: Suspicious System.Net.WebClient DownloadFile/DownloadString"
id: daf89202-c971-4203-88fe-9047c2d0fdad
related:
  - id: 65531a81-a694-4e31-ae04-f8ba5bc33759
    type: derived
  - id: de41232e-12e8-49fa-86bc-c05c7e722df9
    type: derived
status: test
description: This rule flags PowerShell module telemetry where the script context includes System.Net.WebClient and calls either .DownloadFile( or .DownloadString( to retrieve remote content. Such behavior matters because downloading code or data via WebClient is commonly used to stage payloads or pull secondary scripts during attacks. The detection relies on ContextInfo text matching for the WebClient class and the specific download method invocations.
references:
  - https://learn.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadfile?view=net-8.0
  - https://learn.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadstring?view=net-8.0
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_module/posh_pm_susp_download.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-03-05
modified: 2023-01-20
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  product: windows
  category: ps_module
  definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b
detection:
  selection_webclient_:
    ContextInfo|contains: System.Net.WebClient
  selection_function:
    ContextInfo|contains:
      - .DownloadFile(
      - .DownloadString(
  condition: all of selection_*
falsepositives:
  - PowerShell scripts that download content from the Internet
level: medium
license: DRL-1.1

What it detects

This rule flags PowerShell module telemetry where the script context includes System.Net.WebClient and calls either .DownloadFile( or .DownloadString( to retrieve remote content. Such behavior matters because downloading code or data via WebClient is commonly used to stage payloads or pull secondary scripts during attacks. The detection relies on ContextInfo text matching for the WebClient class and the specific download method invocations.

Known false positives

PowerShell scripts that download content from the Internet

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.