PowerShell downloads (Normalized Process Events)

Description

'Finds PowerShell execution events that could involve a download'

Query · kql

imProcessCreate 
  | where Process has_any ("powershell.exe", "powershell_ise.exe") // perfromance pre-filtering
  | extend FileName=tostring(split(TargetProcessName, '\\')[-1])
  | where FileName in~ ("powershell.exe", "powershell_ise.exe")
  | where CommandLine has_any ("Net.WebClient", "DownloadFile", "Invoke-WebRequest", "Invoke-Shellcode", "http:", "https:")
  | project TimeGenerated, Dvc, User, ActingProcessName, FileName, CommandLine, EventVendor, EventProduct
  | top 100 by TimeGenerated
  | extend timestamp = TimeGenerated
Raw source PowerShell downloads (Normalized Process Events) · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 93a4ed6c-83e6-4202-8df4-e340dbd20a38
name: PowerShell downloads (Normalized Process Events)
description: |
  'Finds PowerShell execution events that could involve a download'
requiredDataConnectors: []
tactics:
  - Execution
  - CommandAndControl
query: |
  imProcessCreate 
    | where Process has_any ("powershell.exe", "powershell_ise.exe") // perfromance pre-filtering
    | extend FileName=tostring(split(TargetProcessName, '\\')[-1])
    | where FileName in~ ("powershell.exe", "powershell_ise.exe")
    | where CommandLine has_any ("Net.WebClient", "DownloadFile", "Invoke-WebRequest", "Invoke-Shellcode", "http:", "https:")
    | project TimeGenerated, Dvc, User, ActingProcessName, FileName, CommandLine, EventVendor, EventProduct
    | top 100 by TimeGenerated
    | extend timestamp = TimeGenerated
version: 1.0.1

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.