Detection of PowerShell Web Request Commands via ScriptBlock Logging

Attackers frequently utilize built-in Windows PowerShell cmdlets and command-line utilities to perform web requests, facilitating the download of malicious payloads or the exfiltration of sensitive data. Because these utilities are native to the Windows environment, they are often used as living-off-the-land techniques to blend in with legitimate administrative activity. PowerShell ScriptBlock logging provides visibility into the execution of these commands even when aliases are used. Monitoring for specific commands such as Invoke-WebRequest, Invoke-RestMethod, BitsTransfer, and third-party tools like curl and wget allows security operations teams to detect suspicious external network interactions initiated by PowerShell.

Impact

Successful abuse of these cmdlets can lead to unauthorized code execution, the introduction of secondary malware, and the exfiltration of internal data to attacker-controlled infrastructure. These techniques are common in both initial stage deployment and post-exploitation command-and-control communication.

Recommendation

1. Enable PowerShell ScriptBlock Logging (Event ID 4104) across all Windows endpoints to capture full script content.
2. Deploy the provided Sigma rule to your SIEM to monitor for suspicious web request activity.
3. Establish a baseline for legitimate administrative scripts that utilize these cmdlets and add them to the filter block to reduce false positives.
4. Integrate the identified cmdlets and command aliases into your threat hunting program to investigate anomalous external network connections originating from non-browser processes.