Potential DLL File Download Via PowerShell Invoke-WebRequest

SigmaHQ Detections@sigmaHQ

•updated Jul 28, 2025•2•0•13

Detects potential DLL files being downloaded using the PowerShell Invoke-WebRequest or Invoke-RestMethod cmdlets. This activity is often associated with adversaries transferring malicious tools or components into a compromised environment.