Usage Of Web Request Commands And Cmdlets - ScriptBlock

Detects the use of various web request commands with commandline tools and Windows PowerShell cmdlets (including aliases) via PowerShell scriptblock logs

View on GitHub Open raw file

Detection logic

selection

ScriptBlockText|contains:
  - "[System.Net.WebRequest]::create"
  - "curl "
  - Invoke-RestMethod
  - Invoke-WebRequest
  - " irm "
  - "iwr "
  - Resume-BitsTransfer
  - Start-BitsTransfer
  - "wget "
  - WinHttp.WinHttpRequest

filter

Path|startswith: C:\Packages\Plugins\Microsoft.GuestConfiguration.ConfigurationforWindows\

Condition

selection and not filter

Raw YAML

title: Usage Of Web Request Commands And Cmdlets - ScriptBlock
id: 1139d2e2-84b1-4226-b445-354492eba8ba
related:
    - id: 9fc51a3c-81b3-4fa7-b35f-7c02cf10fd2d
      type: derived
status: test
description: Detects the use of various web request commands with commandline tools and Windows PowerShell cmdlets (including aliases) via PowerShell scriptblock logs
references:
    - https://4sysops.com/archives/use-powershell-to-download-a-file-with-http-https-and-ftp/
    - https://blog.jourdant.me/post/3-ways-to-download-files-with-powershell
author: James Pemberton / @4A616D6573
date: 2019-10-24
modified: 2025-10-20
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    product: windows
    category: ps_script
    definition: 'Requirements: Script Block Logging must be enabled'
detection:
    selection:
        ScriptBlockText|contains:
            - '[System.Net.WebRequest]::create'
            - 'curl '
            - 'Invoke-RestMethod'
            - 'Invoke-WebRequest'
            - ' irm ' # Space before and after to avoid false positives with 'irm' as a substring
            - 'iwr '
            # - 'Net.WebClient' # There are various other rules that cover this, so it is commented out
            - 'Resume-BitsTransfer'
            - 'Start-BitsTransfer'
            - 'wget '
            - 'WinHttp.WinHttpRequest'
    filter:
        Path|startswith: 'C:\Packages\Plugins\Microsoft.GuestConfiguration.ConfigurationforWindows\'
    condition: selection and not filter
falsepositives:
    - Use of Get-Command and Get-Help modules to reference Invoke-WebRequest and Start-BitsTransfer.
level: medium