Detection of PowerShell Download Patterns

This detection focuses on identifying suspicious use of the .NET WebClient class within PowerShell to download files or strings from the internet. This technique is frequently utilized by threat actors during the initial access or post-exploitation phases to fetch secondary payloads, modular malware, or remote access trojans (RATs). While the use of PowerShell for legitimate administrative tasks is common, the specific combination of 'new-object', 'net.webclient', and 'download' methods within the command line is highly indicative of malicious activity. This detection is designed to capture standard PowerShell (powershell.exe), PowerShell ISE (powershell_ise.exe), and PowerShell Core (pwsh.exe).

Impact

Successful exploitation of this technique allows attackers to download and execute arbitrary code on a compromised host. This can lead to full system compromise, exfiltration of sensitive information, or the deployment of ransomware. Attackers leverage these patterns to maintain stealth while bypassing standard file-based security controls by executing payloads directly into memory or saving them to temporary directories.

Recommendation

Deploy the provided Sigma rule to your SIEM and tune it to baseline legitimate administrative scripts that may utilize .NET classes. Ensure that PowerShell script block logging (Event ID 4104) is enabled, as it provides higher visibility into obfuscated command lines that might bypass simple process-creation based detection.