Suspicious PowerShell WebClient Download

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•12

Detects suspicious PowerShell commands that utilize the Net.WebClient object to download files or strings from the internet. This is a common technique used by adversaries for ingress tool transfer or to execute malicious code.