Windows PowerShell Web Access User-Agent in Proxy Logs

Alerts when proxy traffic shows a User-Agent containing "WindowsPowerShell/", consistent with PowerShell web access.

FreeUnreviewedSigmamediumv1

windows-powershell-web-access-user-agent-in-proxy-logs-c8557060

title: Windows PowerShell Web Access User-Agent in Proxy Logs
id: 6d7fee81-7a95-48ee-8dba-127c05d4dc78
status: test
description: This rule flags HTTP proxy traffic where the User-Agent header contains "WindowsPowerShell/", indicating Windows PowerShell Web Access behavior. Attackers can use PowerShell to fetch external resources for command-and-control or stage payloads, making this header a useful indicator. It relies on proxy telemetry that includes the client User-Agent string.
references:
  - https://msdn.microsoft.com/powershell/reference/5.1/microsoft.powershell.utility/Invoke-WebRequest
  - https://github.com/SigmaHQ/sigma/blob/master/rules/web/proxy_generic/proxy_ua_powershell.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-03-13
modified: 2021-11-27
tags:
  - attack.command-and-control
  - attack.t1071.001
logsource:
  category: proxy
detection:
  selection:
    c-useragent|contains: " WindowsPowerShell/"
  condition: selection
falsepositives:
  - Administrative scripts that download files from the Internet
  - Administrative scripts that retrieve certain website contents
level: medium
license: DRL-1.1
related:
  - id: c8557060-9221-4448-8794-96320e6f3e74
    type: derived

What it detects

This rule flags HTTP proxy traffic where the User-Agent header contains "WindowsPowerShell/", indicating Windows PowerShell Web Access behavior. Attackers can use PowerShell to fetch external resources for command-and-control or stage payloads, making this header a useful indicator. It relies on proxy telemetry that includes the client User-Agent string.

Known false positives

Administrative scripts that download files from the Internet
Administrative scripts that retrieve certain website contents

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.