Suspicious PowerShell Download via WebClient

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•16

Detects PowerShell scripts that use the System.Net.WebClient class to download files or strings from the internet. This is a common technique used by adversaries to retrieve malicious payloads or additional tools.