Powershell Downloads
This query detects powershell downloads using `Start-BitsTransfer`, `Invoke-WebRequest`, or `System.Net.WebClient`.
CQL · Falcon Next-Gen SIEMCopy query
#event_simpleName=CommandHistory
| CommandHistory=/Invoke\-WebRequest|Net\.WebClient|Start\-BitsTransfer/i
| regex("(?<URL>https?://[^'\"]+)", field=CommandHistory)
| replace("https://", with="", field=URL, as=ShortURL)
| replace("\/.*", with="", field=ShortURL, as=otx_lookup)
| UrlBase:="https://otx.alienvault.com/indicator/domain/"
| format(format="[Alienvault](%s%s)", field=[UrlBase, otx_lookup], as=DomainLookup)
| table([DomainLookup, URL, ComputerName, UserName, CommandHistory], limit=20000)Powershell_Downloads.yml
T1059
ByteRay GmbH
Hunting
Endpoint
Insight
2025-08-06
2025-08-26
