PowerShell DownloadFile

Title: PowerShell DownloadFile
Status: test
Description:Detects the execution of powershell, a WebClient object creation and the invocation of DownloadFile in a single command line
References:
  -https://www.fireeye.com/blog/threat-research/2020/03/apt41-initiates-global-intrusion-campaign-using-multiple-exploits.html
Author: Florian Roth (Nextron Systems)
Date: 2020-08-28
modified:2021-11-27
Tags:

• -'attack.execution'
• -'attack.t1059.001'
• -'attack.command-and-control'
• -'attack.t1104'
• -'attack.t1105'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    CommandLine|contains|all:
      -'powershell'
      -'.DownloadFile'
      -'System.Net.WebClient'

  condition:selection
Falsepositives:
  -Unknown
Level: high