Suspicious PowerShell Download and Execute Pattern

 1title: Suspicious PowerShell Download and Execute Pattern
 2id: e6c54d94-498c-4562-a37c-b469d8e9a275
 3related:
 4    - id: 3b6ab547-8ec2-4991-b9d2-2b06702a48d7
 5      type: derived
 6status: test
 7description: Detects suspicious PowerShell download patterns that are often used in malicious scripts, stagers or downloaders (make sure that your backend applies the strings case-insensitive)
 8references:
 9    - https://gist.github.com/jivoi/c354eaaf3019352ce32522f916c03d70
10    - https://www.trendmicro.com/en_us/research/22/j/lv-ransomware-exploits-proxyshell-in-attack.html
11author: Florian Roth (Nextron Systems)
12date: 2022-02-28
13modified: 2022-03-01
14tags:
15    - attack.execution
16    - attack.t1059.001
17logsource:
18    category: process_creation
19    product: windows
20detection:
21    selection:
22        CommandLine|contains: # make sure that your backend applies the strings case-insensitive
23            - 'IEX ((New-Object Net.WebClient).DownloadString'
24            - 'IEX (New-Object Net.WebClient).DownloadString'
25            - 'IEX((New-Object Net.WebClient).DownloadString'
26            - 'IEX(New-Object Net.WebClient).DownloadString'
27            - ' -command (New-Object System.Net.WebClient).DownloadFile('
28            - ' -c (New-Object System.Net.WebClient).DownloadFile('
29    condition: selection
30falsepositives:
31    - Software installers that pull packages from remote systems and execute them
32level: high

References

• RedTeam_CheatSheet.ps1

  

  GitHub Gist: instantly share code, notes, and snippets.

  
  Read More

• LV Ransomware Exploits ProxyShell in Attack on a Jordan-based Company

  

  Our blog entry provides a look at an attack involving the LV ransomware on a Jordan-based company from an intrusion analysis standpoint

  
  Read More

Related rules

• AWS EC2 Startup Shell Script Change
• Alternate PowerShell Hosts - PowerShell Module
• Bad Opsec Powershell Code Artifacts
• BloodHound Collection Files
• Certificate Exported Via PowerShell