Detection of DLL Downloads via PowerShell Cmdlets

Adversaries frequently leverage living-off-the-land binaries (LotL) such as PowerShell to facilitate the delivery and execution of malicious payloads. A common technique observed in various malware distribution campaigns involves the use of PowerShell cmdlets - specifically Invoke-WebRequest, Invoke-RestMethod, and their respective aliases (IWR, IRM) - to download remote payloads directly from attacker-controlled infrastructure. When these commands are utilized with the 'OutFile' parameter to save a file with a '.dll' extension, it often indicates an attempt to stage a malicious library for side-loading or reflective loading. Monitoring for these specific command-line patterns allows security operations teams to identify potential initial access or secondary stage malware delivery attempts before the payload is executed.

Attack Chain

1. Initial access is established, potentially via a phishing document or a malicious link.
2. The attacker triggers a PowerShell process (powershell.exe) from the initial infection point.
3. The process executes a download command using Invoke-WebRequest or Invoke-RestMethod.
4. The command specifies a remote URL (HTTP/HTTPS) as the source.
5. The 'OutFile' parameter is used to write the response body to a local file path.
6. The target filename is specified with a .dll extension.
7. The downloaded DLL is staged on the disk for future loading by an application.
8. Final objective is achieved through the subsequent execution of the malicious DLL via techniques like DLL side-loading.

Impact

Successful exploitation of this technique allows an attacker to download arbitrary code onto a target system. If the downloaded DLL is malicious, it can lead to full system compromise, remote access, or the deployment of secondary malware payloads, enabling long-term persistence and data exfiltration.

Recommendation

Deploy the provided Sigma rule to identify PowerShell command-line activity that matches the download-to-DLL pattern. Focus investigations on the source URL identified in the logs and the parent process responsible for spawning the PowerShell instance. Enable process-creation auditing with command-line logging to ensure the 'CommandLine' field is captured for analysis.