PowerShell Web Download Activity

Google SecOps@GoogleSecOps

•updated Jun 6, 2025•1•0•42

This rule detects suspicious PowerShell commands used to download files or content from the web. It specifically looks for the use of '.DownloadString(', '.DownloadFile(', 'Invoke-WebRequest', or 'iwr' within the process command line. These methods are commonly abused by adversaries to retrieve malicious payloads or scripts.