Suspicious Invoke-WebRequest Execution

Title: Suspicious Invoke-WebRequest Execution
Status: test
Description:Detects a suspicious call to Invoke-WebRequest cmdlet where the and output is located in a suspicious location
References:
  -https://www.sentinelone.com/blog/living-off-windows-defender-lockbit-ransomware-sideloads-cobalt-strike-through-microsoft-security-tool/
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-02
modified:2025-07-18
Tags:

• -'attack.command-and-control'
• -'attack.t1105'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
    - Image|endswith:
      - '\powershell_ise.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
    - OriginalFileName:
      - 'powershell_ise.EXE'
      - 'PowerShell.EXE'
      - 'pwsh.dll'
  selection_commands:
    CommandLine|contains:
      -'curl '
      -'Invoke-WebRequest'
      -'iwr '
      -'wget '

  selection_flags:
    CommandLine|contains:
      -' -ur'
      -' -o'

  selection_susp_locations:
    CommandLine|contains:
      -'\AppData\'
      -'\Desktop\'
      -'\Temp\'
      -'\Users\Public\'
      -'%AppData%'
      -'%Public%'
      -'%Temp%'
      -'%tmp%'
      -':\Windows\'

  condition:all of selection_*
Falsepositives:
  -Unknown
Level: high