{"id":"d2e3f2f6-7e09-4bf2-bc5d-90186809e7fb","title":"PowerShell Script With File Upload Capabilities","description":"Detects PowerShell scripts leveraging the \"Invoke-WebRequest\" cmdlet to send data via either \"PUT\" or \"POST\" method.","author":"frack113","status":"test","level":"low","date":"2022-01-07","modified":"2025-07-18","tags":["attack.exfiltration","attack.t1020"],"technique_ids":["T1020"],"logsource":{"product":"windows","category":"ps_script","definition":"bade5735-5ab0-4aa7-a642-a11be0e40872"},"falsepositives":["Unknown"],"references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1020/T1020.md","https://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html","https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/invoke-webrequest?view=powershell-7.4"],"source_path":"rules/windows/powershell/powershell_script/posh_ps_script_with_upload_capabilities.yml","source_sha256":"227a8809e5e4ec6a163a2cb4b8a9f18222b5ecae2739d4688accbeea907b9149","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_script_with_upload_capabilities.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: PowerShell Script With File Upload Capabilities\nid: d2e3f2f6-7e09-4bf2-bc5d-90186809e7fb\nstatus: test\ndescription: Detects PowerShell scripts leveraging the \"Invoke-WebRequest\" cmdlet to send data via either \"PUT\" or \"POST\" method.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1020/T1020.md\n    - https://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html\n    - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/invoke-webrequest?view=powershell-7.4\nauthor: frack113\ndate: 2022-01-07\nmodified: 2025-07-18\ntags:\n    - attack.exfiltration\n    - attack.t1020\nlogsource:\n    product: windows\n    category: ps_script\n    definition: bade5735-5ab0-4aa7-a642-a11be0e40872\ndetection:\n    selection_cmdlet:\n        ScriptBlockText|contains:\n            - 'Invoke-RestMethod'\n            - 'Invoke-WebRequest'\n            - 'irm '\n            - 'iwr '\n    selection_flag:\n        ScriptBlockText|contains:\n            - '-Method \"POST\"'\n            - '-Method \"PUT\"'\n            - '-Method POST'\n            - '-Method PUT'\n            - \"-Method 'POST'\"\n            - \"-Method 'PUT'\"\n    condition: all of selection_*\nfalsepositives:\n    - Unknown\nlevel: low\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1020","id":"T1020","name":"Automated Exfiltration","page":"techniques/enterprise/T1020/"}],"data_path":"data/detection-rules/d2e3f2f6-7e09-4bf2-bc5d-90186809e7fb.json","kind":"sigma"}