Detection of Suspicious Web Request Execution via PowerShell and CLI

Attackers frequently leverage built-in Windows utilities and PowerShell cmdlets to download secondary payloads, fetch malicious configurations, or establish command-and-control (C2) channels. These tools are often preferred because they are natively present in the operating system, allowing attackers to perform network requests while blending in with legitimate administrative activity. Common utilities include curl, wget, and various PowerShell cmdlets such as Invoke-WebRequest and Start-BitsTransfer. Monitoring the execution of these commands is essential for detecting the initial stage of payload delivery or subsequent exfiltration attempts. This brief provides a detection capability for these patterns, focusing on command-line arguments that indicate external data retrieval.

Impact

Successful abuse of these techniques enables attackers to transition from initial access to full payload execution, facilitate lateral movement, or exfiltrate sensitive data. If these activities are not detected, adversaries may maintain persistence and perform data theft undetected for extended periods.

Recommendation

Deploy the provided Sigma rule to your SIEM to monitor for the use of web request-related command-line arguments. Prioritize alerts from servers and endpoints that do not typically require external connectivity or the use of automated download utilities.