Windows Process Creation: PowerShell Downloadstring Used to Fetch Cobalt Strike

Flags PowerShell command lines that use IEX and hidden downloadstring to fetch a Cobalt Strike payload.

FreeUnreviewedSigmahighv1

windows-process-creation-powershell-downloadstring-used-to-fetch-cobalt-strike-aa5b0a40

title: "Windows Process Creation: PowerShell Downloadstring Used to Fetch Cobalt Strike"
id: d2de70a1-1d77-4e7b-8b46-ba0b2c043768
status: test
description: This rule matches Windows process creation events where the command line contains a specific PowerShell downloadstring pattern using IEX and a hidden, non-interactive execution style. Such behavior is commonly used by attackers to stage payloads by retrieving additional tooling after initial execution. The detection relies on command-line telemetry from Windows process creation logs.
references:
  - https://www.sysaid.com/blog/service-desk/on-premise-software-security-vulnerability-notification
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/Lace-Tempest/proc_creation_win_apt_lace_tempest_cobalt_strike_download.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-11-09
tags:
  - attack.execution
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains|all:
      - -nop -w hidden -c IEX ((new-object net.webclient).downloadstring(
      - /a')
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: aa5b0a40-ed88-46aa-9fdc-0337b379ca9d
    type: derived

What it detects

This rule matches Windows process creation events where the command line contains a specific PowerShell downloadstring pattern using IEX and a hidden, non-interactive execution style. Such behavior is commonly used by attackers to stage payloads by retrieving additional tooling after initial execution. The detection relies on command-line telemetry from Windows process creation logs.

Known false positives

Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.