{"id":"0f0450f3-8b47-441e-a31b-15a91dc243e2","title":"Potential DLL File Download Via PowerShell Invoke-WebRequest","description":"Detects potential DLL files being downloaded using the PowerShell Invoke-WebRequest or Invoke-RestMethod cmdlets.","author":"Florian Roth (Nextron Systems), Hieu Tran","status":"test","level":"medium","date":"2023-03-13","modified":"2025-07-18","tags":["attack.command-and-control","attack.execution","attack.t1059.001","attack.t1105"],"technique_ids":["T1059.001","T1105"],"logsource":{"product":"windows","category":"process_creation"},"falsepositives":["Unknown"],"references":["https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution"],"source_path":"rules/windows/process_creation/proc_creation_win_powershell_download_dll.yml","source_sha256":"ea9bdcd2c9ef362ebab5afa71b122974fde44cc3c070b5d51a7884a605faf250","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_powershell_download_dll.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potential DLL File Download Via PowerShell Invoke-WebRequest\nid: 0f0450f3-8b47-441e-a31b-15a91dc243e2\nstatus: test\ndescription: Detects potential DLL files being downloaded using the PowerShell Invoke-WebRequest or Invoke-RestMethod cmdlets.\nreferences:\n    - https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution\nauthor: Florian Roth (Nextron Systems), Hieu Tran\ndate: 2023-03-13\nmodified: 2025-07-18\ntags:\n    - attack.command-and-control\n    - attack.execution\n    - attack.t1059.001\n    - attack.t1105\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection:\n        CommandLine|contains:\n            - 'Invoke-RestMethod '\n            - 'Invoke-WebRequest '\n            - 'IRM '\n            - 'IWR '\n        CommandLine|contains|all:\n            - 'http'\n            - 'OutFile'\n            - '.dll'\n    condition: selection\nfalsepositives:\n    - Unknown\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059.001","id":"T1059.001","name":"PowerShell","page":"techniques/enterprise/T1059.001/"},{"key":"enterprise/T1105","id":"T1105","name":"Ingress Tool Transfer","page":"techniques/enterprise/T1105/"}],"data_path":"data/detection-rules/0f0450f3-8b47-441e-a31b-15a91dc243e2.json","kind":"sigma"}