PowerShell Payload Download Command Detection

Ethan Andrews@eandrews

•updated Jun 9, 2026•5•0•14

Detects PowerShell script executions that contain common cmdlets and classes used for downloading external payloads. This rule specifically looks for `Invoke-WebRequest`, `Invoke-RestMethod`, `DownloadString`, `DownloadFile`, `Net.WebClient`, and `Start-BitsTransfer` within PowerShell command lines, focusing on scripts executed from files.