Detecting PowerShell-Based Ingress Tool Transfers

Attackers frequently leverage PowerShell to perform ingress tool transfers, moving malware or post-exploitation tooling from external systems into a compromised environment. By utilizing native system administration utilities, actors attempt to blend in with legitimate automation and maintenance tasks. This threat activity involves PowerShell processes making network connections for DNS resolution to identify remote resources, followed by the creation of potentially malicious files on the local filesystem.

Defenders should prioritize monitoring for PowerShell execution that culminates in file creation events, specifically when the domain resolution does not align with known trusted services (e.g., Microsoft update endpoints, standard package managers, or internal infrastructure). Given the prevalence of PowerShell in administrative routines, effective detection requires correlation between network events (DNS lookups) and file system events, combined with contextual filtering to suppress benign administrative activity.

Attack Chain

1. Attacker establishes initial access or presence on a target Windows host.
2. Attacker launches PowerShell or PowerShell ISE to facilitate file retrieval.
3. PowerShell performs a DNS query to resolve a remote, untrusted, or attacker-controlled domain.
4. The network connection is successfully established to the resolved IP address.
5. The PowerShell process invokes download commands (e.g., Invoke-WebRequest, IEX) to fetch the payload.
6. PowerShell writes the retrieved content to the disk (e.g., an .exe, .dll, or .ps1 file).
7. The file creation event is logged by the system, identifying the PowerShell process as the actor.
8. Attacker subsequently executes the downloaded file to advance their objective, such as persistence or lateral movement.

Impact

Successful ingress tool transfer allows attackers to introduce secondary malware, backdoors, or credential harvesting tools into a network. This facilitates long-term persistence, lateral movement, and data exfiltration. If left undetected, this activity provides the attacker with a platform to expand their footprint across the organization's infrastructure.

Recommendation

1. Deploy the provided Sigma detection rule to monitor for PowerShell-initiated downloads.
2. Baseline your environment's PowerShell usage to identify legitimate update or automation domains that should be added to the exclusion list.
3. Enable Sysmon or Elastic Defend to capture both network (DNS) and file creation events, ensuring process-level lineage is available for investigation.
4. Use the provided investigation guide to analyze the parent process tree, examine digital signatures, and assess the reputation of external domains identified in the DNS logs.