Query: Sigma rule for Detects potential DLL files being downloaded using the PowerShell Invoke-WebRequest or Invoke-RestMethod cmdlets.
Matching passage: Sigma rule: Detects potential DLL files being downloaded using the PowerShell Invoke-WebRequest or Invoke-RestMethod cmdlets.. Logsource: windows / process_creation. Rule: title: Potential DLL File Download Via PowerShell Invoke-WebRequest id: 0f0450f3-8b47-441e-a31b-15a91dc243e2 status: test description: Detects potential DLL files being downloaded using the PowerShell Invoke-WebRequest or Invoke-RestMethod cmdlets. references: - https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution author: Florian Roth (Nextron Systems), Hieu Tran date: 2023-03-13 modified: 2025-07-18 tags: - attack.command-and-control - attack.execution - attack.t1059.001 - attack.t1105 logsource: product: windows category: process_creation detection: selection: CommandLine|contains: - 'Invoke-RestMethod ' - 'Invoke-WebRequest ' - 'IRM ' - 'IWR ' CommandLine|contains|all: - http - OutFile - .dll condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects Schtask creations that point to a suspicious folder or an environment variable often used by malware. Logsource: windows / process_creation. Rule: title: Schedule Task Creation From Env Variable Or Potentially Suspicious Path Via Schtasks.EXE id: 81325ce1-be01-4250-944f-b4789644556f related: - id: 43f487f0-755f-4c2a-bce7-d6d2eec2fcf8 type: derived status: test description: Detects Schtask creations that point to a suspicious folder or an environment variable often used by malware references: - https://www.welivesecurity.com/2022/01/18/donot-go-do-not-respawn/ - https://www.joesandbox.com/analysis/514608/0/html#324415FF7D8324231381BAD48A052F85DF04 - https://blog.talosintelligence.com/gophish-powerrat-dcrat/ author: Florian Roth (Nextron Systems) date: 2022-02-21 modified: 2025-10-07 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.t1053.005 logsource: product: windows category: process_creation detection: selection_1_create: Image|endswith: \schtasks.exe CommandLine|contains|windash: ' /create ' selection_1_all_folders: CommandLine|contains: - :\Perflogs - :\Users\All Users\ - :\Users\Default\ - :\Users\Public - :\Windows\Temp - \AppData\Local\ - \AppData\Roaming\ - '%AppData%' - '%Public%' selection_2_parent: ParentCommandLine|endswith: \svchost.exe -k netsvcs -p -s Schedule selection_2_some_folders: CommandLine|contains: - :\Perflogs - :\Windows\Temp - \Users\Public - '%Public%' filter_optional_other: - ParentCommandLine|contains: unattended.ini - CommandLine|contains: update_task.xml filter_optional_team_viewer: CommandLine|contains: /Create /TN TVInstallRestore /TR filter_optional_avira_install: CommandLine|contains|all: - '/Create /Xml ' - \Temp\.CR. - \Avira_Security_Installation.xml filter_optional_avira_other: CommandLine|contains|all: - /Create /F /TN - '/Xml ' - \Temp\ - Avira_ CommandLine|contains: - .tmp\UpdateFallbackTask.xml - .tmp\WatchdogServiceControlManagerTimeout.xml - .tmp\SystrayAutostart.xml - .tmp\MaintenanceTask.xml filter_optional_klite_codec: CommandLine|contains|all: - \Temp\ - '/Create /TN "klcp_update" /XML ' - \klcp_update_task.xml condition: ( all of selection_1_* or all of selection_2_* ) and not 1 of filter_optional_* falsepositives: - Benign scheduled tasks creations or executions that happen often during software installations - Software that uses the AppData folder and scheduled tasks to update the software in the AppData folders level: medium