Usage Of Web Request Commands And Cmdlets - ScriptBlock — Sigma Rule

Rule metadata and linked tags

Author: James Pemberton / @4A616D6573. Source status: test; severity: medium. Source dates: 2019-10-24 / 2025-10-20.

{
  "product": "windows",
  "category": "ps_script",
  "definition": "Requirements: Script Block Logging must be enabled"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: 5ee23f49c8dc5ea222c6e4c4796f2327aa60850f78b1f1ff2152fc6219fa528a

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Usage Of Web Request Commands And Cmdlets - ScriptBlock
id: 1139d2e2-84b1-4226-b445-354492eba8ba
related:
    - id: 9fc51a3c-81b3-4fa7-b35f-7c02cf10fd2d
      type: derived
status: test
description: Detects the use of various web request commands with commandline tools and Windows PowerShell cmdlets (including aliases) via PowerShell scriptblock logs
references:
    - https://4sysops.com/archives/use-powershell-to-download-a-file-with-http-https-and-ftp/
    - https://blog.jourdant.me/post/3-ways-to-download-files-with-powershell
author: James Pemberton / @4A616D6573
date: 2019-10-24
modified: 2025-10-20
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    product: windows
    category: ps_script
    definition: 'Requirements: Script Block Logging must be enabled'
detection:
    selection:
        ScriptBlockText|contains:
            - '[System.Net.WebRequest]::create'
            - 'curl '
            - 'Invoke-RestMethod'
            - 'Invoke-WebRequest'
            - ' irm ' # Space before and after to avoid false positives with 'irm' as a substring
            - 'iwr '
            # - 'Net.WebClient' # There are various other rules that cover this, so it is commented out
            - 'Resume-BitsTransfer'
            - 'Start-BitsTransfer'
            - 'wget '
            - 'WinHttp.WinHttpRequest'
    filter:
        Path|startswith: 'C:\Packages\Plugins\Microsoft.GuestConfiguration.ConfigurationforWindows\'
    condition: selection and not filter
falsepositives:
    - Use of Get-Command and Get-Help modules to reference Invoke-WebRequest and Start-BitsTransfer.
level: medium

Original YAML and metadata in JSON

False positives

• Use of Get-Command and Get-Help modules to reference Invoke-WebRequest and Start-BitsTransfer.

Source references

• https://4sysops.com/archives/use-powershell-to-download-a-file-with-http-https-and-ftp/
• https://blog.jourdant.me/post/3-ways-to-download-files-with-powershell