deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Get-ADUser Enumeration Using UserAccountControl Flags
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-03-17
ATT&CK techniques: T1033
Log source: windows/ps_script

Description:
Detects AS-REP roasting is an attack that is often-overlooked. It is not very common as you have to explicitly set accounts that do not require pre-authentication.

Detection logic:
{
  "selection": {
    "ScriptBlockText|contains|all": [
      "Get-ADUser",
      "-Filter",
      "useraccountcontrol",
      "-band",
      "4194304"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1069.002/T1069.002.md#atomic-test-11---get-aduser-enumeration-using-useraccountcontrol-flags-as-rep-roasting
  - https://shellgeek.com/useraccountcontrol-flags-to-manipulate-properties/
Sigma Detection Rule: Manipulation of User Computer or Group Security Principals Across AD
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2021-12-28
ATT&CK techniques: T1136.002
Log source: windows/ps_script

Description:
Adversaries may create a domain account to maintain access to victim systems.
Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain..


Detection logic:
{
  "selection": {
    "ScriptBlockText|contains": "System.DirectoryServices.AccountManagement"
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1136.002/T1136.002.md#atomic-test-3---create-a-new-domain-account-using-powershell
  - https://learn.microsoft.com/en-us/dotnet/api/system.directoryservices.accountmanagement?view=net-8.0
Sigma Detection Rule: Suspicious PowerShell Invocations - Specific
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro
Date: 2017-03-05
ATT&CK techniques: T1059.001
Log source: windows/ps_script

Description:
Detects suspicious PowerShell invocation command parameters

Detection logic:
{
  "selection_convert_b64": {
    "ScriptBlockText|contains|all": [
      "-nop",
      " -w ",
      "hidden",
      " -c ",
      "[Convert]::FromBase64String"
    ]
  },
  "selection_iex_selection": {
    "ScriptBlockText|contains|all": [
      " -w ",
      "hidden",
      "-noni",
      "-nop",
      " -c ",
      "iex",
      "New-Object"
    ]
  },
  "selection_enc_selection": {
    "ScriptBlockText|contains|all": [
      " -w ",
      "hidden",
      "-ep",
      "bypass",
      "-Enc"
    ]
  },
  "selection_reg_selection": {
    "ScriptBlockText|contains|all": [
      "powershell",
      "reg",
      "add"
    ],
    "ScriptBlockText|contains": [
      "\\software\\microsoft\\windows\\currentversion\\run",
      "\\software\\wow6432node\\microsoft\\windows\\currentversion\\run",
      "\\software\\microsoft\\windows\\currentversion\\policies\\explorer\\run"
    ]
  },
  "selection_webclient_selection": {
    "ScriptBlockText|contains|all": [
      "bypass",
      "-noprofile",
      "-windowstyle",
      "hidden",
      "new-object",
      "system.net.webclient",
      ".download"
    ]
  },
  "selection_iex_webclient": {
    "ScriptBlockText|contains|all": [
      "iex",
      "New-Object",
      "Net.WebClient",
      ".Download"
    ]
  },
  "filter_chocolatey": {
    "ScriptBlockText|contains": [
      "(New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1",
      "(New-Object System.Net.WebClient).DownloadString('https:

References:
  - Internal Research
  - https://github.com/HackTricks-wiki/hacktricks/blob/e4c7b21b8f36c97c35b7c622732b38a189ce18f7/src/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.md
Sigma Detection Rule: Registry Modification Attempt Via VBScript - PowerShell
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-08-13
ATT&CK techniques: T1112, T1059.005
Log source: windows/ps_script

Description:
Detects attempts to modify the registry using VBScript's CreateObject("Wscript.shell") and RegWrite methods embedded within PowerShell scripts or commands.
Threat actors commonly embed VBScript code within PowerShell to perform registry modifications, attempting to evade detection that monitors for direct registry access through traditional tools.
This technique can be used for persistence, defense evasion, and privilege escalation by modifying registry keys without using regedit.exe, reg.exe, or PowerShell's native registry cmdlets.


Detection logic:
{
  "selection": {
    "ScriptBlockText|contains|all": [
      "CreateObject",
      "Wscript.shell",
      ".RegWrite"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.linkedin.com/posts/mauricefielenbach_livingofftheland-redteam-persistence-activity[PII_REDACTED]182051843-TE00/
  - https://www.nextron-systems.com/2025/07/29/detecting-the-most-popular-mitre-persistence-method-registry-run-keys-startup-folder/
  - https://detect.fyi/hunting-fileless-malware-in-the-windows-registry-1339ccde00ad
Sigma Detection Rule: Invoke-Obfuscation VAR+ Launcher - PowerShell
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Jonathan Cheong, oscd.community
Date: 2020-10-15
ATT&CK techniques: T1027, T1059.001
Log source: windows/ps_script

Description:
Detects Obfuscated use of Environment Variables to execute PowerShell

Detection logic:
{
  "selection_4104": {
    "ScriptBlockText|re": "cmd.{0,5}(?:/c|/r)(?:\\s|)\"set\\s[a-zA-Z]{3,6}.*(?:\\{\\d\\}){1,}\\\\\"\\s+?-f(?:.*\\)){1,}.*\""
  },
  "condition": "selection_4104"
}

References:
  - https://github.com/SigmaHQ/sigma/issues/1009
Sigma Detection Rule: SyncAppvPublishingServer Bypass Powershell Restriction - PS Module
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Ensar Şamil, @sblmsrsn, OSCD Community
Date: 2020-10-05
ATT&CK techniques: T1218
Log source: windows/ps_module

Description:
Detects SyncAppvPublishingServer process execution which usually utilized by adversaries to bypass PowerShell execution restrictions.

Detection logic:
{
  "selection": {
    "ContextInfo|contains": "SyncAppvPublishingServer.exe"
  },
  "condition": "selection"
}

References:
  - https://lolbas-project.github.io/lolbas/Binaries/Syncappvpublishingserver/
Sigma Detection Rule: Suspicious Get Information for SMB Share - PowerShell Module
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: frack113
Date: 2021-12-15
ATT&CK techniques: T1069.001
Log source: windows/ps_module

Description:
Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and
to identify potential systems of interest for Lateral Movement.
Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.


Detection logic:
{
  "selection": [
    {
      "Payload|contains": "get-smbshare"
    },
    {
      "ContextInfo|contains": "get-smbshare"
    }
  ],
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1069.002/T1069.002.md
Sigma Detection Rule: Potential RemoteFXvGPUDisablement.EXE Abuse - PowerShell Module
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), frack113
Date: 2021-07-13
ATT&CK techniques: T1218
Log source: windows/ps_module

Description:
Detects PowerShell module creation where the module Contents are set to "function Get-VMRemoteFXPhysicalVideoAdapter". This could be a sign of potential abuse of the "RemoteFXvGPUDisablement.exe" binary which is known to be vulnerable to module load-order hijacking.

Detection logic:
{
  "selection": {
    "Payload|contains": "ModuleContents=function Get-VMRemoteFXPhysicalVideoAdapter {"
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md
  - https://github.com/redcanaryco/AtomicTestHarnesses/blob/7e1e4da116801e3d6fcc6bedb207064577e40572/TestHarnesses/T1218_SignedBinaryProxyExecution/InvokeRemoteFXvGPUDisablementCommand.ps1
Sigma Detection Rule: Invoke-Obfuscation Via Use MSHTA - PowerShell Module
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nikita Nazarov, oscd.community
Date: 2020-10-08
ATT&CK techniques: T1027, T1059.001
Log source: windows/ps_module

Description:
Detects Obfuscated Powershell via use MSHTA in Scripts

Detection logic:
{
  "selection": {
    "Payload|contains|all": [
      "set",
      "&&",
      "mshta",
      "vbscript:createobject",
      ".run",
      "(window.close)"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/SigmaHQ/sigma/issues/1009
Sigma Detection Rule: Invoke-Obfuscation RUNDLL LAUNCHER - PowerShell Module
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Timur Zinniatullin, oscd.community
Date: 2020-10-18
ATT&CK techniques: T1027, T1059.001
Log source: windows/ps_module

Description:
Detects Obfuscated Powershell via RUNDLL LAUNCHER

Detection logic:
{
  "selection_4103": {
    "Payload|contains|all": [
      "rundll32.exe",
      "shell32.dll",
      "shellexec_rundll",
      "powershell"
    ]
  },
  "condition": "selection_4103"
}

References:
  - https://github.com/SigmaHQ/sigma/issues/1009
Sigma Detection Rule: Bad Opsec Powershell Code Artifacts
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: ok @securonix invrep_de, oscd.community
Date: 2020-10-09
ATT&CK techniques: T1059.001
Log source: windows/ps_module

Description:
focuses on trivial artifacts observed in variants of prevalent offensive ps1 payloads, including
Cobalt Strike Beacon, PoshC2, Powerview, Letmein, Empire, Powersploit, and other attack payloads
that often undergo minimal changes by attackers due to bad opsec.


Detection logic:
{
  "selection_4103": {
    "Payload|contains": [
      "$DoIt",
      "harmj0y",
      "mattifestation",
      "_RastaMouse",
      "tifkin_",
      "0xdeadbeef"
    ]
  },
  "condition": "selection_4103"
}

References:
  - https://newtonpaul.com/analysing-fileless-malware-cobalt-strike-beacon/
  - https://labs.sentinelone.com/top-tier-russian-organized-cybercrime-group-unveils-fileless-stealthy-powertrick-backdoor-for-high-value-targets/
  - https://www.mdeditor.tw/pl/pgRt
Sigma Detection Rule: Suspicious Computer Machine Password by PowerShell
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-02-21
ATT&CK techniques: T1078
Log source: windows/ps_module

Description:
The Reset-ComputerMachinePassword cmdlet changes the computer account password that the computers use to authenticate to the domain controllers in the domain.
You can use it to reset the password of the local computer.


Detection logic:
{
  "selection": {
    "ContextInfo|contains": "Reset-ComputerMachinePassword"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/reset-computermachinepassword?view=powershell-5.1
  - https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/
Sigma Detection Rule: Zip A Folder With PowerShell For Staging In Temp  - PowerShell Module
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), frack113
Date: 2021-07-20
ATT&CK techniques: T1074.001
Log source: windows/ps_module

Description:
Detects PowerShell scripts that make use of the "Compress-Archive" Cmdlet in order to compress folders and files where the output is stored in a potentially suspicious location that is used often by malware for exfiltration.
An adversary might compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.


Detection logic:
{
  "selection": {
    "ContextInfo|contains|all": [
      "Compress-Archive -Path*-DestinationPath $env:TEMP",
      "Compress-Archive -Path*-DestinationPath*\\AppData\\Local\\Temp\\",
      "Compress-Archive -Path*-DestinationPath*:\\Windows\\Temp\\"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1074.001/T1074.001.md
  - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a
Sigma Detection Rule: Invoke-Obfuscation Via Use Clip - PowerShell Module
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nikita Nazarov, oscd.community
Date: 2020-10-09
ATT&CK techniques: T1027, T1059.001
Log source: windows/ps_module

Description:
Detects Obfuscated Powershell via use Clip.exe in Scripts

Detection logic:
{
  "selection_4103": {
    "Payload|re": "(?i)echo.*clip.*&&.*(Clipboard|i`?n`?v`?o`?k`?e`?)"
  },
  "condition": "selection_4103"
}

References:
  - https://github.com/SigmaHQ/sigma/issues/1009
Sigma Detection Rule: Invoke-Obfuscation STDIN+ Launcher - PowerShell Module
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Jonathan Cheong, oscd.community
Date: 2020-10-15
ATT&CK techniques: T1027, T1059.001
Log source: windows/ps_module

Description:
Detects Obfuscated use of stdin to execute PowerShell

Detection logic:
{
  "selection_4103": {
    "Payload|re": "cmd.{0,5}(?:/c|/r).+powershell.+(?:\\$\\{?input\\}?|noexit).+\""
  },
  "condition": "selection_4103"
}

References:
  - https://github.com/SigmaHQ/sigma/issues/1009
Sigma Detection Rule: Invoke-Obfuscation Obfuscated IEX Invocation - PowerShell Module
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Daniel Bohannon (@Mandiant/@FireEye), oscd.community
Date: 2019-11-08
ATT&CK techniques: T1027, T1059.001
Log source: windows/ps_module

Description:
Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the code block cited in the reference section below

Detection logic:
{
  "selection_payload": [
    {
      "Payload|re": "\\$PSHome\\[\\s*\\d{1,3}\\s*\\]\\s*\\+\\s*\\$PSHome\\["
    },
    {
      "Payload|re": "\\$ShellId\\[\\s*\\d{1,3}\\s*\\]\\s*\\+\\s*\\$ShellId\\["
    },
    {
      "Payload|re": "\\$env:Public\\[\\s*\\d{1,3}\\s*\\]\\s*\\+\\s*\\$env:Public\\["
    },
    {
      "Payload|re": "\\$env:ComSpec\\[(\\s*\\d{1,3}\\s*,){2}"
    },
    {
      "Payload|re": "\\*mdr\\*\\W\\s*\\)\\.Name"
    },
    {
      "Payload|re": "\\$VerbosePreference\\.ToString\\("
    },
    {
      "Payload|re": "\\[String\\]\\s*\\$VerbosePreference"
    }
  ],
  "condition": "selection_payload"
}

References:
  - https://github.com/danielbohannon/Invoke-Obfuscation/blob/f20e7f843edd0a3a7716736e9eddfa423395dd26/Out-ObfuscatedStringCommand.ps1#L873-L888
Sigma Detection Rule: Suspicious Get Local Groups Information
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: frack113
Date: 2021-12-12
ATT&CK techniques: T1069.001
Log source: windows/ps_module

Description:
Detects the use of PowerShell modules and cmdlets to gather local group information.
Adversaries may use local system permission groups to determine which groups exist and which users belong to a particular group such as the local administrators group.


Detection logic:
{
  "selection_localgroup": [
    {
      "Payload|contains": [
        "get-localgroup ",
        "get-localgroupmember "
      ]
    },
    {
      "ContextInfo|contains": [
        "get-localgroup ",
        "get-localgroupmember "
      ]
    }
  ],
  "selection_wmi_module": [
    {
      "Payload|contains": [
        "get-wmiobject ",
        "gwmi ",
        "get-ciminstance ",
        "gcim "
      ]
    },
    {
      "ContextInfo|contains|all": [
        "get-wmiobject ",
        "gwmi ",
        "get-ciminstance ",
        "gcim "
      ]
    }
  ],
  "selection_wmi_class": [
    {
      "Payload|contains": "win32_group"
    },
    {
      "ContextInfo|contains": "win32_group"
    }
  ],
  "condition": "selection_localgroup or all of selection_wmi_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1069.001/T1069.001.md
Sigma Detection Rule: Invoke-Obfuscation CLIP+ Launcher - PowerShell Module
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Jonathan Cheong, oscd.community
Date: 2020-10-13
ATT&CK techniques: T1027, T1059.001
Log source: windows/ps_module

Description:
Detects Obfuscated use of Clip.exe to execute PowerShell

Detection logic:
{
  "selection_4103": {
    "Payload|re": "cmd.{0,5}(?:/c|/r).+clip(?:\\.exe)?.{0,4}&&.+clipboard]::\\(\\s\\\\\"\\{\\d\\}.+-f.+\""
  },
  "condition": "selection_4103"
}

References:
  - https://github.com/SigmaHQ/sigma/issues/1009
Sigma Detection Rule: Invoke-Obfuscation Via Use Rundll32 - PowerShell Module
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nikita Nazarov, oscd.community
Date: 2019-10-08
ATT&CK techniques: T1027, T1059.001
Log source: windows/ps_module

Description:
Detects Obfuscated Powershell via use Rundll32 in Scripts

Detection logic:
{
  "selection_4103": {
    "Payload|contains|all": [
      "&&",
      "rundll32",
      "shell32.dll",
      "shellexec_rundll"
    ],
    "Payload|contains": [
      "value",
      "invoke",
      "comspec",
      "iex"
    ]
  },
  "condition": "selection_4103"
}

References:
  - https://github.com/SigmaHQ/sigma/issues/1009
Sigma Detection Rule: AD Groups Or Users Enumeration Using PowerShell - PoshModule
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: frack113
Date: 2021-12-15
ATT&CK techniques: T1069.001
Log source: windows/ps_module

Description:
Adversaries may attempt to find domain-level groups and permission settings.
The knowledge of domain-level permission groups can help adversaries determine which groups exist and which users belong to a particular group.
Adversaries may use this information to determine which users have elevated permissions, such as domain administrators.


Detection logic:
{
  "selection_ad_principal": [
    {
      "Payload|contains": "get-ADPrincipalGroupMembership"
    },
    {
      "ContextInfo|contains": "get-ADPrincipalGroupMembership"
    }
  ],
  "selection_get_aduser": [
    {
      "Payload|contains|all": [
        "get-aduser",
        "-f ",
        "-pr ",
        "DoesNotRequirePreAuth"
      ]
    },
    {
      "ContextInfo|contains|all": [
        "get-aduser",
        "-f ",
        "-pr ",
        "DoesNotRequirePreAuth"
      ]
    }
  ],
  "condition": "1 of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1069.002/T1069.002.md
Sigma Detection Rule: HackTool - Evil-WinRm Execution - PowerShell Module
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2024-02-25
Log source: windows/ps_module

Description:
Detects the execution of Evil-WinRM via PowerShell Module logs by leveraging the hardcoded strings inside the utility.


Detection logic:
{
  "selection_wsm": {
    "ContextInfo|contains": [
      ":\\Windows\\System32\\wsmprovhost.exe",
      ":\\Windows\\SysWOW64\\wsmprovhost.exe"
    ]
  },
  "selection_payload_1": {
    "Payload|contains": [
      "value=\"(get-location).path",
      "value=\"(get-item*).length",
      "Invoke-Binary ",
      "Donut-Loader -process_id*-donutfile",
      "Bypass-4MSI",
      "IEX ([System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String($a))).replace('???','')"
    ]
  },
  "selection_payload_2": {
    "Payload|contains|all": [
      "$servicios = Get-ItemProperty \"registry::HKLM\\System\\CurrentControlSet\\Services\\\"",
      "Where-Object {$_.imagepath -notmatch \"system\" -and $_.imagepath -ne $null } | Select-Object pschildname,imagepath"
    ]
  },
  "selection_payload_3": {
    "Payload|contains|all": [
      "$a +=  \\\"$($_.FullName.Replace('\\\\','/'))/\\\"}else{  $a += \\\"$($_.FullName.Replace('\\\\', '/'))\\\" }",
      "$a=@();$"
    ]
  },
  "condition": "selection_wsm and 1 of selection_payload_*"
}

References:
  - https://github.com/Hackplayers/evil-winrm/blob/7514b055d67ec19836e95c05bd63e7cc47c4c2aa/evil-winrm.rb
  - https://github.com/search?q=repo%3AHackplayers%2Fevil-winrm++shell.run%28&type=code
Sigma Detection Rule: Clear PowerShell History - PowerShell Module
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Ilyas Ochkov, Jonhnathan Ribeiro, Daniil Yugoslavskiy, oscd.community
Date: 2019-10-25
ATT&CK techniques: T1070.003
Log source: windows/ps_module

Description:
Detects keywords that could indicate clearing PowerShell history

Detection logic:
{
  "selection_1a_payload": {
    "Payload|contains": [
      "del",
      "Remove-Item",
      "rm"
    ]
  },
  "selection_1b_payload": {
    "Payload|contains": "(Get-PSReadlineOption).HistorySavePath"
  },
  "selection_payload_2": {
    "Payload|contains|all": [
      "Set-PSReadlineOption",
      "\u2013HistorySaveStyle",
      "SaveNothing"
    ]
  },
  "selection_payload_3": {
    "Payload|contains|all": [
      "Set-PSReadlineOption",
      "-HistorySaveStyle",
      "SaveNothing"
    ]
  },
  "condition": "1 of selection_payload_* or all of selection_1*"
}

References:
  - https://gist.github.com/hook-s3c/7363a856c3cdbadeb71085147f042c1a
Sigma Detection Rule: Suspicious PowerShell Download - PoshModule
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2017-03-05
ATT&CK techniques: T1059.001
Log source: windows/ps_module

Description:
Detects suspicious PowerShell download command

Detection logic:
{
  "selection_webclient_": {
    "ContextInfo|contains": "System.Net.WebClient"
  },
  "selection_function": {
    "ContextInfo|contains": [
      ".DownloadFile(",
      ".DownloadString("
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://learn.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadfile?view=net-8.0
  - https://learn.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadstring?view=net-8.0