{"id":"3236fcd0-b7e3-4433-b4f8-86ad61a9af2d","title":"PowerShell Download Via Net.WebClient - PowerShell Classic","description":"Detects PowerShell download activity, via the .DownloadFile() or .DownloadString() methods of the Net.WebClient class.\nThis technique is often abused by attackers to download additional payloads.\n","author":"Florian Roth (Nextron Systems)","status":"test","level":"low","date":"2017-03-05","modified":"2026-04-28","tags":["attack.execution","attack.command-and-control","attack.t1059.001","attack.t1105"],"technique_ids":["T1059.001","T1105"],"logsource":{"product":"windows","category":"ps_classic_start"},"falsepositives":["This activity may be used by legitimate software, such as patch management tools or software updaters. Investigate any such activity and apply the necessary filter."],"references":["https://www.trendmicro.com/en_us/research/22/j/lv-ransomware-exploits-proxyshell-in-attack.html"],"source_path":"rules/windows/powershell/powershell_classic/posh_pc_download_via_webclient.yml","source_sha256":"66bef8fdc9ecf4b3ca7b1375f06a30f987bc4728d19151f555f12dcbbbadb7ba","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_classic/posh_pc_download_via_webclient.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: PowerShell Download Via Net.WebClient - PowerShell Classic\nid: 3236fcd0-b7e3-4433-b4f8-86ad61a9af2d\nrelated:\n    - id: 65531a81-a694-4e31-ae04-f8ba5bc33759\n      type: derived\nstatus: test\ndescription: |\n    Detects PowerShell download activity, via the .DownloadFile() or .DownloadString() methods of the Net.WebClient class.\n    This technique is often abused by attackers to download additional payloads.\nreferences:\n    - https://www.trendmicro.com/en_us/research/22/j/lv-ransomware-exploits-proxyshell-in-attack.html\nauthor: Florian Roth (Nextron Systems)\ndate: 2017-03-05\nmodified: 2026-04-28\ntags:\n    - attack.execution\n    - attack.command-and-control\n    - attack.t1059.001\n    - attack.t1105\nlogsource:\n    product: windows\n    category: ps_classic_start\ndetection:\n    selection_webclient:\n        Data|contains: 'Net.WebClient'\n    selection_download:\n        Data|contains:\n            - '.DownloadFile('\n            - '.DownloadString('\n    condition: all of selection_*\nfalsepositives:\n    - This activity may be used by legitimate software, such as patch management tools or software updaters. Investigate any such activity and apply the necessary filter.\nlevel: low\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059.001","id":"T1059.001","name":"PowerShell","page":"techniques/enterprise/T1059.001/"},{"key":"enterprise/T1105","id":"T1105","name":"Ingress Tool Transfer","page":"techniques/enterprise/T1105/"}],"data_path":"data/detection-rules/3236fcd0-b7e3-4433-b4f8-86ad61a9af2d.json","kind":"sigma"}