Suspicious PowerShell Download via WebClient

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•14

Detects suspicious PowerShell commands that utilize 'System.Net.WebClient' to download files or strings from the internet. This technique is commonly used by adversaries for ingress tool transfer or to fetch additional malicious payloads.