PowerShell Web Request with Modified User Agent

SigmaHQ Detections@sigmaHQ

•updated Jul 28, 2025•0•14

This rule detects PowerShell scripts that utilize web request cmdlets (Invoke-WebRequest, Invoke-RestMethod, irm, iwr) along with the '-UserAgent' parameter. Adversaries often modify user agents to mimic legitimate traffic or specific applications, blending in with normal network activity to evade detection while communicating with command and control servers or exfiltrating data.