Windows Process Creation: PowerShell downloads setup.msi via Invoke-WebRequest for PaperCut MF/NG

title: "Windows Process Creation: PowerShell downloads setup.msi via Invoke-WebRequest for PaperCut MF/NG"
id: 9b1fa746-0c4d-4abf-8645-487e9cce7736
status: test
description: This rule flags Windows process creation where the command line uses PowerShell with hidden execution to run Invoke-WebRequest and download setup.msi. It also matches the subsequent silent MSI installation pattern executed via msiexec with IntegratorLogin parameters. Attackers often use this combination to quickly stage and install exploitation-related payloads while reducing user visibility. The detection relies on Windows process creation telemetry, specifically the CommandLine fields for PowerShell and msiexec.
references:
  - https://www.huntress.com/blog/critical-vulnerabilities-in-papercut-print-management-software
  - https://www.papercut.com/kb/Main/PO-1216-and-PO-1219
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/PaperCut-Print-Management-Exploitation/proc_creation_win_papercut_print_management_exploitation_indicators.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-04-25
tags:
  - attack.execution
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection_1:
    CommandLine|contains|all:
      - " /c "
      - powershell
      - -nop -w hidden
      - Invoke-WebRequest
      - setup.msi
      - -OutFile
  selection_2:
    CommandLine|contains|all:
      - "msiexec "
      - "/i "
      - "setup.msi "
      - "/qn "
      - IntegratorLogin=fimaribahundq
  condition: 1 of selection_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: de1bd0b6-6d59-417c-86d9-a44114aede3b
    type: derived