Powershell Download and Execute IEX

 1title: Powershell Download and Execute IEX
 2status: experimental
 3description: powershell download file from internet and execute
 4author: Joe Security
 5date: 2019-10-22
 6id: 200007
 7threatname:
 8behaviorgroup: 1
 9classification: 8
10mitreattack:
11
12logsource:
13    category: process_creation
14    product: windows
15detection:
16    selection:
17        CommandLine:
18            - '*\powershell.exe* iex *((New-Object Net.WebClient).DownloadString(*'
19            - '*powershell*[string][char[]]@(0x*Set-Alias*Net.WebClient*.DownloadString(*'
20            - '*powershell*iex (new-object system.net.webclient).downloadstring*'
21            - '*iex ( [string][system.text.encoding]::ascii.getstring([system.convert]::frombase64string( ((new-object net.webclient).downloadstring(*'
22            - '*powershell*.DownloadFile([System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String(*>&*'
23            - '*iex (new-object net.webclient).downloadstring(*'
24            - '*powershell -command iex (*downloadstring*'
25            - '*iex (new-object net.webclient).downloadfile(*'
26            - '*powershell*-command*iex(*http*'
27            - '*-command iex (new-object*downloadstring*'
28            - '*$path*iex(*.web*-replace*'
29            - '*iex ((new-object system.net.webclient).downloadstring(*'
30            - '*powershell*.webclient)*iex*'
31            - '*iex(new-object net.webclient).downloadstring(*'
32            - '*iex ((new-object net.webclient).downloadstring(*'
33            - '*http*.replace(*iex*'
34    condition: selection
35level: critical