Remote File Download via PowerShell

Attackers frequently use PowerShell to download malware and tools into compromised environments. This is often done through command and control channels, leveraging PowerShell's widespread availability and utility within administrative tasks. This creates an attractive avenue for executing malicious code. This detection identifies instances where PowerShell is used to download executable and script files from untrusted remote locations, specifically focusing on network connections to non-standard or suspicious domains followed by file creation events associated with the downloaded content. This activity is significant because it often represents the initial stages of malware deployment or lateral movement within a network. The rule focuses on Windows systems and aims to reduce false positives by excluding common update domains.

Attack Chain

1. A user's machine is compromised, possibly through a phishing email or other means (not explicitly detailed in source).
2. The attacker establishes a command and control channel to the compromised machine.
3. The attacker uses PowerShell (powershell.exe, pwsh.exe, or powershell_ise.exe) to initiate a network connection.
4. PowerShell resolves a DNS request to an external domain that is not on an approved list (e.g., *.microsoft.com, *.azureedge.net).
5. A file is created on the system, and the file extension is an executable type (exe, dll, ps1, bat, cmd, vbs, vbe, js, jse, wsh, wsf, sct, hta, cpl, scr, pif, com) or file has executable header bytes.
6. The created file's path and name are checked against common benign locations, such as temporary directories, but the file is not found in the exclusion list.
7. The downloaded executable or script is then executed, leading to further compromise or lateral movement.
8. The final objective is often to establish persistence, escalate privileges, or exfiltrate sensitive data.

Impact

Successful exploitation allows attackers to introduce malware, establish persistence, and potentially compromise critical systems. Uncontrolled PowerShell-based downloads can lead to widespread infection, data breaches, and significant operational disruption. While the exact number of victims and sectors targeted are not specified in the source, the potential impact can be severe, especially if administrative credentials are compromised.

Recommendation

• Enable Sysmon process creation, network connection, and file creation logging to capture the events necessary for these detections.
• Deploy the Sigma rule "PowerShell Remote File Download" to your SIEM to detect suspicious PowerShell-initiated downloads. Tune the rule's exclusions to minimize false positives in your environment.
• Investigate any alerts generated by the "PowerShell Remote File Download" rule promptly, focusing on the parent processes and the reputation of the downloaded files.
• Block connections to the suspicious domains identified in your environment using the "Remote File Download via PowerShell" rule's dns.question.name field at your firewall or DNS resolver.