Suspicious PowerShell Invoke-WebRequest Usage for File Downloads

Adversaries frequently abuse built-in Windows administrative utilities, specifically the PowerShell Invoke-WebRequest (and its aliases: iwr, curl, wget), to facilitate the download of second-stage payloads from remote infrastructure. By targeting non-standard, world-writable directories such as Temp, AppData, or the Public user profile, attackers attempt to bypass file integrity monitoring or application control policies. This activity is a known component of various campaigns, including ransomware deployments where adversaries sideload beacons or malware components via living-off-the-land techniques. Monitoring for these specific command-line flags and directory paths is essential for early detection of initial access or post-exploitation stage activities.

Impact

Successful exploitation of this technique typically precedes full system compromise, malware execution, or sensitive data exfiltration. Adversaries using these tools within common directory structures can effectively camouflage malicious file drops as legitimate system or user activity, potentially delaying detection until post-delivery stages like execution or persistence are established.

Recommendation

Deploy the provided Sigma rule to monitor for suspicious command-line patterns involving PowerShell web requests directed at high-risk file system locations.

• Enable Sysmon or Windows Event Log (Event ID 4688) process creation logging to populate the required fields for detection.
• Tune the detection to exclude legitimate software installers or administrative scripts that use standardized directory structures for temporary file processing.
• Review internal scripts that automate file retrieval to ensure they use approved organizational infrastructure rather than public/temp directory locations.