Permalink
Find file Copy path
Fetching contributors…
Cannot retrieve contributors at this time
19 lines (18 sloc) 486 Bytes
title: Suspicious PowerShell Download
status: experimental
description: Detects suspicious PowerShell download command
tags:
- attack.execution
- attack.t1086
author: Florian Roth
logsource:
product: windows
service: powershell
detection:
keywords:
- 'System.Net.WebClient).DownloadString('
- 'system.net.webclient).downloadfile('
condition: keywords
falsepositives:
- PowerShell scripts that download content from the Internet
level: medium