Windows PowerShell Web Access User-Agent Containing "WindowsPowerShell/" (Proxy Logs)

ATT&CK techniques

C2

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
- T1071.001Web Protocols
Exfiltration
Impact

What it detects

This rule matches proxy events where the HTTP User-Agent header contains the substring "WindowsPowerShell/", indicating PowerShell Web access. Attackers can use PowerShell’s web requests for command-and-control or to download additional payloads, making this header a useful indicator of suspicious automation. The detection relies on proxy telemetry that records the client User-Agent string.

Reporting behind it

Related detections9 linkedT1071.001 — drag to rearrange

Malicious HarborWatch RAT Command and Control Beacon by User Agent (via proxy)

Suspicious UAT-10608 Credential Harvesting C2 Beacon via HTTP

Malicious BadIIS C2 Communication via lwxatisme User-Agent

Possible PS1Bot C2 Beacon With Drive Serial URI Pattern (via proxy)

Suspicious WarmCookie C2 Beacon With Fixed Firefox User-Agent

Malicious Renamed Python Interpreter Executing nvidia.py RAT

Malicious Self-Signed TLS Certificate With Exploit Subject via Zeek X509

Suspicious Network Connection From wabmig.exe (Turian Injection)

Suspicious wmicodegen.dll Sideload by inetinfo.exe (UAT-8099 Cobalt Strike)

Windows PowerShell Web Access User-Agent Containing "WindowsPowerShell/" (Proxy Logs)

Pivot detection · T1071.001 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-powershell-web-access-user-agent-in-proxy-logs-c8557060

title: Windows PowerShell Web Access User-Agent Containing "WindowsPowerShell/" (Proxy Logs)
id: 6d7fee81-7a95-48ee-8dba-127c05d4dc78
status: test
description: This rule matches proxy events where the HTTP User-Agent header contains the substring "WindowsPowerShell/", indicating PowerShell Web access. Attackers can use PowerShell’s web requests for command-and-control or to download additional payloads, making this header a useful indicator of suspicious automation. The detection relies on proxy telemetry that records the client User-Agent string.
references:
  - https://msdn.microsoft.com/powershell/reference/5.1/microsoft.powershell.utility/Invoke-WebRequest
  - https://github.com/SigmaHQ/sigma/blob/master/rules/web/proxy_generic/proxy_ua_powershell.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-03-13
modified: 2021-11-27
tags:
  - attack.command-and-control
  - attack.t1071.001
logsource:
  category: proxy
detection:
  selection:
    c-useragent|contains: " WindowsPowerShell/"
  condition: selection
falsepositives:
  - Administrative scripts that download files from the Internet
  - Administrative scripts that retrieve certain website contents
level: medium
license: DRL-1.1
related:
  - id: c8557060-9221-4448-8794-96320e6f3e74
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL