Suspicious Invoke-WebRequest Execution With Direct IP

SigmaHQ Detections@sigmaHQ

•updated Jul 28, 2025•1•0•16

Detects PowerShell execution using Invoke-WebRequest (or its aliases like curl, wget, Invoke-RestMethod, irm, iwr) to connect to an IP address directly. This behavior can be indicative of malware downloading additional stages or establishing command and control, especially when avoiding DNS resolution.