Suspicious Invoke-WebRequest Output to Unusual Location

SigmaHQ Detections@sigmaHQ

•updated Jul 28, 2025•1•0•14

Detects suspicious execution of PowerShell's Invoke-WebRequest cmdlet (or its aliases like curl, iwr, wget) when the output is directed to a suspicious location. Adversaries often use this technique to download malicious tools or files into user-controlled directories like AppData, Desktop, Temp, or Public folders, or directly into the Windows directory, which are not typical locations for legitimate Invoke-WebRequest output.