PowerShell Net.WebClient Casing Anomalies (Encoded)

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•14

Detects PowerShell command line contents that include suspicious abnormal casing in the 'Net.Webclient' string (e.g., 'nEt.WEbCliEnT') as used in obfuscation techniques. This rule specifically looks for base64 encoded variations of 'Net.Webclient' with mixed casing, indicating an attempt to evade detection.