Suspicious PowerShell WebClient Downloads via PoshModule
Alerts on PowerShell module activity referencing System.Net.WebClient with DownloadFile/DownloadString calls to fetch remote content.
- Product
- windows
- Category
- ps_module
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2017-03-05
- Updated
- 2026-07-31
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags PowerShell module activity where the command context contains .NET WebClient and invokes DownloadFile or DownloadString. These patterns are commonly used to retrieve remote content during execution, which can support initial access and staging for subsequent payloads. It relies on telemetry that captures module or command ContextInfo strings containing the WebClient type and the specific download method calls.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadfile?view=net-8.0
- learn.microsoft.comhttps://learn.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadstring?view=net-8.0
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_module/posh_pm_susp_download.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Suspicious PowerShell WebClient Downloads via PoshModule
id: daf89202-c971-4203-88fe-9047c2d0fdad
related:
- id: 65531a81-a694-4e31-ae04-f8ba5bc33759
type: derived
- id: de41232e-12e8-49fa-86bc-c05c7e722df9
type: derived
status: test
description: This rule flags PowerShell module activity where the command context contains .NET WebClient and invokes DownloadFile or DownloadString. These patterns are commonly used to retrieve remote content during execution, which can support initial access and staging for subsequent payloads. It relies on telemetry that captures module or command ContextInfo strings containing the WebClient type and the specific download method calls.
references:
- https://learn.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadfile?view=net-8.0
- https://learn.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadstring?view=net-8.0
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_module/posh_pm_susp_download.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-03-05
modified: 2023-01-20
tags:
- attack.execution
- attack.t1059.001
logsource:
product: windows
category: ps_module
definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b
detection:
selection_webclient_:
ContextInfo|contains: System.Net.WebClient
selection_function:
ContextInfo|contains:
- .DownloadFile(
- .DownloadString(
condition: all of selection_*
falsepositives:
- PowerShell scripts that download content from the Internet
level: medium
license: DRL-1.1