Detection of Suspicious PowerShell WebRequest User-Agent Modification

Adversaries frequently use PowerShell cmdlets such as Invoke-WebRequest, Invoke-RestMethod, iwr, and irm to perform C2 operations, data exfiltration, or payload delivery. To evade network-based detection, monitoring, or filtering, attackers modify the default PowerShell User-Agent string to match common browsers or legitimate software. By blending their communication patterns with standard HTTP/S traffic, they reduce the effectiveness of simple signatures targeting default PowerShell identifiers. Defenders must monitor PowerShell Script Block Logging for the combination of network-request cmdlets and the usage of the -UserAgent flag to identify potentially unauthorized outbound connections.

Impact

Successful abuse of PowerShell for network communication facilitates C2 channel establishment, lateral movement, and data exfiltration. If left undetected, this technique allows attackers to persist within the environment while remaining concealed within standard web traffic noise.

Recommendation

• Enable PowerShell Script Block Logging (Event ID 4104) to capture the full execution context of scripts containing web request cmdlets.
• Deploy the provided Sigma rule to your SIEM and tune against common internal administrative scripts that perform API calls with custom User-Agents.
• Baseline common internal PowerShell traffic to identify unauthorized use of Invoke-WebRequest or Invoke-RestMethod from non-administrative endpoints.