PowerShell Net.WebClient Download Activity

SigmaHQ Detections@sigmaHQ

•updated Oct 20, 2025•1•0•16

Detects PowerShell processes executing commands that utilize `Net.WebClient` to download content, indicated by the presence of `new-object`, `net.webclient).`, and `download` keywords in the command line, along with either `string(` or `file(`. This pattern is commonly used by adversaries for ingress tool transfer or to fetch additional malicious payloads.