Windows PowerShell User Agent in Web Requests

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•27

This rule detects HTTP requests where the User-Agent header contains ' WindowsPowerShell/'. This pattern is indicative of PowerShell making web requests, potentially for downloading files, interacting with web services, or command and control activities. This can be a legitimate administrative activity but is also frequently abused by adversaries.