Sigma rule: PowerShell Download Via Net.WebClient - PowerShell Classic

Rule

Title

PowerShell Download Via Net.WebClient - PowerShell Classic

Status

test

Level

low

Author

Florian Roth (Nextron Systems)

Date

2017-03-05

Modified

2026-04-28

File

rules/windows/powershell/powershell_classic/posh_pc_download_via_webclient.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects PowerShell download activity, via the .DownloadFile() or .DownloadString() methods of the Net.WebClient class.
This technique is often abused by attackers to download additional payloads.

Log source

product

windows

category

ps_classic_start

Detection

selection_webclient:
    Data|contains: 'Net.WebClient'
selection_download:
    Data|contains:
        - '.DownloadFile('
        - '.DownloadString('
condition: all of selection_*

False positives (as the rule lists them)

• This activity may be used by legitimate software, such as patch management tools or software updaters. Investigate any such activity and apply the necessary filter.

Tags

• attack.execution
• attack.command-and-control
• attack.t1059.001
• attack.t1105

MITRE ATT&CK ids this rule names

• T1059.001
• T1105

Related rules

• 65531a81-a694-4e31-ae04-f8ba5bc33759 (derived)

References

• https://www.trendmicro.com/en_us/research/22/j/lv-ransomware-exploits-proxyshell-in-attack.html

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/powershell/powershell_classic/posh_pc_download_via_webclient.yml