Download cradle

Detects PowerShell download-cradle patterns (web download primitives inside a command line or script block) used to pull second-stage payloads.

• T1105Ingress Tool Transfer· Command and Control
• T1059.001Command and Scripting Interpreter: PowerShell· Execution

Legitimate installers and update scripts download files with the same primitives. Judge by the download source, the invoking parent, and what happened to the payload afterwards.

Declarative YAML read by the detection engine — data, never executed. Confidence 75%. Source: rules/windows/powershell_download_cradle.yaml, licensed under the Apache License 2.0.

id: windows.powershell.download_cradle
version: 1.0.0
status: stable
severity: high
confidence: 0.75
platforms: [windows]
mitre_techniques: [T1105, T1059.001]
description: |
  Detects PowerShell download-cradle patterns (web download primitives inside a command line
  or script block) used to pull second-stage payloads.
match:
  event_category_any: [script, process]
  command_line_contains_any:
    - "DownloadString"
    - "DownloadFile"
    - "Invoke-WebRequest"
    - "Invoke-RestMethod"
    - "Net.WebClient"
    - "Start-BitsTransfer"
false_positive_guidance: |
  Legitimate installers and update scripts download files with the same primitives. Judge by
  the download source, the invoking parent, and what happened to the payload afterwards.

• Curl pipe to shellSeverity high
• Certutil Download / DecodeSeverity high
• Encoded PowerShell CommandSeverity high
• PowerShell Download CradleSeverity high
• BITS transfer by user accountSeverity medium
• PowerShell credential dumpingSeverity critical