Suspicious PowerShell Download and Execute Pattern

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•14

This rule detects suspicious PowerShell command-line patterns indicative of downloading and executing remote content. Specifically, it looks for the use of `IEX (New-Object Net.WebClient).DownloadString` or `(New-Object System.Net.WebClient).DownloadFile` which are commonly abused by malicious scripts, stagers, and downloaders to fetch and run payloads from the internet.