Windows PowerShell Web Access User-Agent Containing "WindowsPowerShell/" (Proxy Logs)
Alerts when proxy traffic shows a User-Agent containing "WindowsPowerShell/", consistent with PowerShell web access.
- Category
- proxy
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2017-03-13
- Updated
- 2026-07-31
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule matches proxy events where the HTTP User-Agent header contains the substring "WindowsPowerShell/", indicating PowerShell Web access. Attackers can use PowerShell’s web requests for command-and-control or to download additional payloads, making this header a useful indicator of suspicious automation. The detection relies on proxy telemetry that records the client User-Agent string.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows PowerShell Web Access User-Agent Containing "WindowsPowerShell/" (Proxy Logs)
id: 6d7fee81-7a95-48ee-8dba-127c05d4dc78
status: test
description: This rule matches proxy events where the HTTP User-Agent header contains the substring "WindowsPowerShell/", indicating PowerShell Web access. Attackers can use PowerShell’s web requests for command-and-control or to download additional payloads, making this header a useful indicator of suspicious automation. The detection relies on proxy telemetry that records the client User-Agent string.
references:
- https://msdn.microsoft.com/powershell/reference/5.1/microsoft.powershell.utility/Invoke-WebRequest
- https://github.com/SigmaHQ/sigma/blob/master/rules/web/proxy_generic/proxy_ua_powershell.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-03-13
modified: 2021-11-27
tags:
- attack.command-and-control
- attack.t1071.001
logsource:
category: proxy
detection:
selection:
c-useragent|contains: " WindowsPowerShell/"
condition: selection
falsepositives:
- Administrative scripts that download files from the Internet
- Administrative scripts that retrieve certain website contents
level: medium
license: DRL-1.1
related:
- id: c8557060-9221-4448-8794-96320e6f3e74
type: derived