Potentially Suspicious File Download From File Sharing Domain Via PowerShell

SigmaHQ Detections@sigmaHQ

•updated Sep 22, 2025•1•0•22

This rule detects the use of PowerShell (powershell.exe or pwsh.exe) to download files from known file-sharing or content delivery network (CDN) domains. It specifically looks for command-line arguments indicative of file download operations, such as '.DownloadString(', '.DownloadFile(', 'Invoke-WebRequest', 'iwr', and 'wget'. The rule aims to identify suspicious activity where PowerShell is leveraged to retrieve potentially malicious payloads from untrusted or commonly abused online services.