Potentially Suspicious File Download From File Sharing Domain Via PowerShell.EXE

Severity: high
Author: Nasreddine Bencherchali (Nextron Systems)
Source: upstream

Detects potentially suspicious file downloads from file sharing domains using PowerShell.exe

Event coverage

Provider	Event ID	Title
Sysmon	1	Process creation

Stages and Predicates

Stage 1: `all of selection_img`

or:
Image|endswith: '\powershell.exe'
Image|endswith: '\pwsh.exe'
OriginalFileName: PowerShell.EXE
OriginalFileName: pwsh.dll

Stage 2: `all of selection_websites`

or:
CommandLine|contains: anonfiles.com
CommandLine|contains: cdn.discordapp.com
CommandLine|contains: ddns.net
CommandLine|contains: dl.dropboxusercontent.com
CommandLine|contains: ghostbin.co
CommandLine|contains: glitch.me
CommandLine|contains: gofile.io
CommandLine|contains: hastebin.com
CommandLine|contains: mediafire.com
CommandLine|contains: mega.nz
CommandLine|contains: onrender.com
CommandLine|contains: pages.dev
CommandLine|contains: paste.ee
CommandLine|contains: pastebin.com
CommandLine|contains: pastebin.pl
CommandLine|contains: pastetext.net
CommandLine|contains: pixeldrain.com
CommandLine|contains: privatlab.com
CommandLine|contains: privatlab.net
CommandLine|contains: send.exploit.in
CommandLine|contains: sendspace.com
CommandLine|contains: storage.googleapis.com
CommandLine|contains: storjshare.io
CommandLine|contains: supabase.co
CommandLine|contains: temp.sh
CommandLine|contains: transfer.sh
CommandLine|contains: trycloudflare.com
CommandLine|contains: ufile.io
CommandLine|contains: w3spaces.com
CommandLine|contains: workers.dev

Stage 3: `all of selection_download`

or:
CommandLine|contains: '.DownloadFile('
CommandLine|contains: '.DownloadString('
CommandLine|contains: 'Invoke-WebRequest '
CommandLine|contains: 'iwr '
CommandLine|contains: 'wget '

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`CommandLine`	match	`.DownloadFile(` corpus 3 (sigma 3) `.DownloadString(` corpus 3 (sigma 3) `Invoke-WebRequest` corpus 4 (sigma 4) `anonfiles.com` corpus 5 (sigma 5) `cdn.discordapp.com` corpus 5 (sigma 5) `ddns.net` corpus 5 (sigma 5) `dl.dropboxusercontent.com` corpus 5 (sigma 5) `ghostbin.co` corpus 5 (sigma 5) `glitch.me` corpus 5 (sigma 5) `gofile.io` corpus 5 (sigma 5) `hastebin.com` corpus 5 (sigma 5) `iwr` corpus 8 (sigma 8) `mediafire.com` corpus 5 (sigma 5) `mega.nz` corpus 5 (sigma 5) `onrender.com` corpus 5 (sigma 5) `pages.dev` corpus 5 (sigma 5) `paste.ee` corpus 5 (sigma 5) `pastebin.com` corpus 5 (sigma 5) `pastebin.pl` corpus 5 (sigma 5) `pastetext.net` corpus 5 (sigma 5) `pixeldrain.com` corpus 3 (sigma 3) `privatlab.com` corpus 5 (sigma 5) `privatlab.net` corpus 5 (sigma 5) `send.exploit.in` corpus 5 (sigma 5) `sendspace.com` corpus 5 (sigma 5) `storage.googleapis.com` corpus 5 (sigma 5) `storjshare.io` corpus 5 (sigma 5) `supabase.co` corpus 5 (sigma 5) `temp.sh` corpus 5 (sigma 5) `transfer.sh` corpus 5 (sigma 5) `trycloudflare.com` corpus 5 (sigma 5) `ufile.io` corpus 5 (sigma 5) `w3spaces.com` corpus 5 (sigma 5) `wget` corpus 7 (sigma 7) `workers.dev` corpus 5 (sigma 5)
`Image`	ends_with	`\powershell.exe` corpus 143 (sigma 143) `\pwsh.exe` corpus 140 (sigma 140)
`OriginalFileName`	eq	`PowerShell.EXE` corpus 64 (sigma 60, splunk 4) `pwsh.dll` corpus 72 (sigma 68, splunk 4)