CmdID / Rules / Windows

Usage Of Web Request Commands And Cmdlets

A Sigma rule for process creation on Windows, by James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger.

medium 1 ATT&CK technique 18 everyday examples trip it

What it looks for

its detection, as SigmaHQ writes it

detection:
  selection:
    CommandLine|contains:
      - '[System.Net.WebRequest]::create'
      - 'curl '
      - 'Invoke-RestMethod'
      - 'Invoke-WebRequest'
      - ' irm '
      - 'iwr '
      - 'Resume-BitsTransfer'
      - 'Start-BitsTransfer'
      - 'wget '
      - 'WinHttp.WinHttpRequest'
  condition: selection

The rule’s detection, its selections and fields in order of name. The whole rule, with its references and false positives, is on SigmaHQ, by James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger, under the Detection Rule License 1.1. CmdID evaluates it on a command line alone: a test on what a command line cannot show, such as the parent process or the user, is not met.

Command lines that trip it

everyday examples from tldr-pages, CC BY 4.0, each read by CmdID

Download the contents of a URL to a file on the page for invoke-webrequest

Invoke-WebRequest http://example.com -OutFile path\to\fileIdentify

Only return raw HTML data instead of parsing it under Internet Explorer (PowerShell 3.0-5.1 only) on the page for invoke-webrequest

Invoke-WebRequest http://example.com -UseBasicParsingIdentify

Send form-encoded data (POST request of type application/x-www-form-urlencoded) on the page for invoke-webrequest

Invoke-WebRequest -Method Post -Body @{ name='bob' } http://example.com/formIdentify

Send a request with an extra header, using a custom HTTP method on the page for invoke-webrequest

Invoke-WebRequest -Headers @{ X-My-Header = '123' } -Method PUT http://example.comIdentify

Send data in JSON format, specifying the appropriate content-type header on the page for invoke-webrequest

Invoke-WebRequest -Body '{"name":"bob"}' -ContentType 'application/json' http://example.com/users/1234Identify

Pass a username and password for server authentication on the page for invoke-webrequest

Invoke-WebRequest -Headers @{ Authorization = "Basic "+ [System.Convert]::ToBase64String([System.Text.Encoding]::ASCII.GetBytes("myusername:mypassword")) } http://example.com

Identify

Get JSON strings from a web service and convert them to PowerShell objects on the page for ConvertFrom-Json

# Ensures that Invoke-WebRequest uses TLS 1.2
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
$j = Invoke-WebRequest 'https://api.github.com/repos/PowerShell/PowerShell/issues' |
ConvertFrom-Json

Identify

Use the Module parameter to discover which commands were imported into the session on the page for Import-PSSession

PS C:> $M = Import-PSSession -Session $S -CommandName bits -FormatTypeName bits
PS C:> Get-Command -Module $M
CommandType Name
----------- ----
Function Add-BitsFile
Function Complete-BitsTransfer
Function Get-BitsTransfer
Function Remove-BitsTransfer
Function Resume-BitsTransfer
Function Set-BitsTransfer
Function Start-BitsTransfer
Function Suspend-BitsTransfer

Identify

Get the PowerShell RSS feed on the page for Invoke-RestMethod

Invoke-RestMethod -Uri https://devblogs.microsoft.com/powershell/feed/ |
Format-Table -Property Title, pubDate

Identify

Example 2 on the page for Invoke-RestMethod

$Cred = Get-Credential

# Next, allow the use of self-signed SSL certificates.

[System.Net.ServicePointManager]::ServerCertificateValidationCallback = { $true }

# Create variables to store the values consumed by the Invoke-RestMethod command.
# The search variable contents are later embedded in the body variable.

$Server = 'server.contoso.com'
$Url = "https://${server}:8089/services/search/jobs/export"
$Search = "search index=_internal | reverse | table index,host,source,sourcetype,_raw"

# The cmdlet handles URL encoding. The body variable describes the search criteria, specifies CSV as
# the output mode, and specifies a time period for returned data that starts two days ago and ends
# one day ago. The body variable specifies values for parameters that apply to the particular REST
# API with which Invoke-RestMethod is communicating.

$Body = @{
search = $Search
output_mode = "csv"
earliest_time = "-2d@d"
latest_time = "-1d@d"
}

# Now, run the Invoke-RestMethod command with all variables in place, specifying a path and file
# name for the resulting CSV output file.

Invoke-RestMethod -Method Post -Uri $url -Credential $Cred -Body $body -OutFile output.csv

{"preview":true,"offset":0,"result":{"sourcetype":"contoso1","count":"9624"}}

{"preview":true,"offset":1,"result":{"sourcetype":"contoso2","count":"152"}}

{"preview":true,"offset":2,"result":{"sourcetype":"contoso3","count":"88494"}}

{"preview":true,"offset":3,"result":{"sourcetype":"contoso4","count":"15277"}}

Identify

Pass multiple headers on the page for Invoke-RestMethod

$headers = @{
'userId' = 'UserIDValue'
'token' = 'TokenValue'
}
Invoke-RestMethod -Uri $uri -Method Post -Headers $headers -Body $body

Identify

Submitting form data on the page for Invoke-RestMethod

$R = Invoke-WebRequest https://website.com/login.aspx
$R.Forms[0].Name = "MyName"
$R.Forms[0].Password = "MyPassword"
Invoke-RestMethod https://website.com/service.aspx -Body $R.Forms[0]

Identify

And 6 more examples on CmdID’s program pages.

ATT&CK

the techniques it is tagged with

T1059.001Command and Scripting Interpreter: PowerShell

Usage Of Web Request Commands And Cmdlets

What it looks for

Command lines that trip it

ATT&CK

Other rules for T1059.001 Command and Scripting Interpreter: PowerShell