PowerShell Download Pattern

 1title: PowerShell Download Pattern
 2id: 3b6ab547-8ec2-4991-b9d2-2b06702a48d7
 3related:
 4    - id: e6c54d94-498c-4562-a37c-b469d8e9a275
 5      type: derived
 6    - id: 8f70ac5f-1f6f-4f8e-b454-db19561216c5
 7      type: obsolete
 8status: test
 9description: Detects a Powershell process that contains download commands in its command line string
10references:
11    - https://blog.redteam.pl/2020/06/black-kingdom-ransomware.html
12    - https://lab52.io/blog/winter-vivern-all-summer/
13    - https://hatching.io/blog/powershell-analysis/
14author: Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro
15date: 2019-01-16
16modified: 2025-10-20
17tags:
18    - attack.execution
19    - attack.t1059.001
20logsource:
21    category: process_creation
22    product: windows
23detection:
24    selection_img:
25        - Image|endswith:
26              - '\powershell_ise.exe'
27              - '\powershell.exe'
28              - '\pwsh.exe'
29        - OriginalFileName:
30              - 'PowerShell_ISE.EXE'
31              - 'PowerShell.EXE'
32              - 'pwsh.dll'
33    selection_cli:
34        CommandLine|contains|all:
35            - 'new-object'
36            - 'net.webclient).'
37            - 'download'
38        CommandLine|contains:
39            - 'string('
40            - 'file('
41    condition: all of selection_*
42falsepositives:
43    - Unknown
44level: medium

References

• Black Kingdom ransomware (TTPs & IOC)

  red team, blue team, penetration testing, red teaming, threat hunting, digital forensics, incident response, cyber security, IT security

  
  Read More

• Winter Vivern – all Summer

  

  In July, 2021, Lab52 found a currently active infection campaign (domain still up at the time of this writing) attributed to a group referred as Wintervivern after a report published by the researc...

  
  Read More

• Hatching - Automated malware analysis solutions

  

  Automated malware analysis with Hatching Triage, the high-volume sandbox solution for SOCs, CERTs, SOARs, and MSSPs.

  
  Read More

Related rules

• Usage Of Web Request Commands And Cmdlets
• Usage Of Web Request Commands And Cmdlets - ScriptBlock
• Potential Exploitation of GoAnywhere MFT Vulnerability
• Alternate PowerShell Hosts - PowerShell Module
• Suspicious WSMAN Provider Image Loads