title: PowerShell Download from URL
author: Florian Roth, oscd.community, Jonhnathan Ribeiro
date: 2019/01/16
description: Detects a Powershell process that contains download commands in its command
  line string
detection:
  SELECTION_1:
    EventID: 1
  SELECTION_2:
    Image: '*\powershell.exe'
  SELECTION_3:
    CommandLine: '*new-object*'
  SELECTION_4:
    CommandLine: '*net.webclient).*'
  SELECTION_5:
    CommandLine: '*download*'
  SELECTION_6:
    CommandLine:
    - '*string(*'
    - '*file(*'
  condition: (SELECTION_1 and SELECTION_2 and SELECTION_3 and SELECTION_4 and SELECTION_5
    and SELECTION_6)
falsepositives:
- unknown
fields:
- CommandLine
- ParentCommandLine
id: 3b6ab547-8ec2-4991-b9d2-2b06702a48d7
level: medium
logsource:
  category: process_creation
  product: windows
status: experimental
tags:
- attack.t1086
- attack.execution
- attack.t1059.001
ruletype: SIGMA