PowerShell downloads

Description

Finds PowerShell execution events that could involve a download.

Query · kql

DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("powershell.exe", "powershell_ise.exe")
| where ProcessCommandLine has "Net.WebClient"
   or ProcessCommandLine has "DownloadFile"
   or ProcessCommandLine has "Invoke-WebRequest"
   or ProcessCommandLine has "Invoke-Shellcode"
   or ProcessCommandLine has "http"
   or ProcessCommandLine has "IEX"
   or ProcessCommandLine has "Start-BitsTransfer"
   or ProcessCommandLine has "mpcmdrun.exe"
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine
| top 100 by Timestamp
Raw source PowerShell downloads · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: c34d1d0e-1cf4-45d0-b628-a2cfde329182
name: PowerShell downloads
description: |
  Finds PowerShell execution events that could involve a download.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
query: |
  DeviceProcessEvents
  | where Timestamp > ago(7d)
  | where FileName in~ ("powershell.exe", "powershell_ise.exe")
  | where ProcessCommandLine has "Net.WebClient"
     or ProcessCommandLine has "DownloadFile"
     or ProcessCommandLine has "Invoke-WebRequest"
     or ProcessCommandLine has "Invoke-Shellcode"
     or ProcessCommandLine has "http"
     or ProcessCommandLine has "IEX"
     or ProcessCommandLine has "Start-BitsTransfer"
     or ProcessCommandLine has "mpcmdrun.exe"
  | project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine
  | top 100 by Timestamp

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.