Techniques
Sample rules
PowerShell Download from Code Hosting Service
- source: splunk
- technicques:
Description
This analytic detects PowerShell Script Block Logging (Event ID 4104) events that use common download methods to retrieve files directly from raw-content URLs on GitHub, GitLab, or Codeberg. These code hosting services can be abused to stage payloads, but administrators and developers also download files from them. A match identifies a download attempt; it does not establish that the file was successfully retrieved or executed. Review the full script block, destination path, process ancestry, and related endpoint activity.
Detection logic
`powershell` EventCode=4104 ScriptBlockText IN ("*.DownloadFile(*", "*.DownloadData(*", "*.DownloadString(*", "*Invoke-WebRequest*", "*Invoke-RestMethod*", "*Start-BitsTransfer*", "*iwr *", "*irm *", "*curl *", "*wget *")
| where match(
ScriptBlockText,
"(?ix)
(?:
\.Download(?:File
|Data
|String)\s*\(\s*['\"]?
|
(?:Invoke-WebRequest
|Invoke-RestMethod
|iwr
|irm)
(?:\s+(?:-Uri\s+)?
|\b[^;\r\n]{0,200}?\s-Uri\s+)['\"]?
|
Start-BitsTransfer\b[^;\r\n]{0,200}?-Source\s+['\"]?
|
(?:curl
|wget)\s+(?:-Uri\s+)?['\"]?
)
https?://
(?:
raw\.githubusercontent\.com/[^/\s'\"]+/[^/\s'\"]+/[^/\s'\"]+(?:/[^/\s'\"]+)*
|
(?:github
|gitlab)\.com/[^/\s'\"]+/[^/\s'\"]+/(?:-/)?raw/(?:refs/(?:heads
|tags)/)?[^/\s'\"]+(?:/[^/\s'\"]+)*
|
codeberg\.org/[^/\s'\"]+/[^/\s'\"]+/raw/(?:branch/)?[^/\s'\"]+(?:/[^/\s'\"]+)*
)
\.(?:bat
|cmd
|ps1
|js
|vbs
|vbe
|py
|zip
|7z
|rar
|tar
|gz
|exe
|dll
|msi)
(?:[?#][^\s'\"]*)?
(?=['\"\s),;]
|$)"
)
| fillnull
| stats count min(_time) as firstTime max(_time) as lastTime
by dest signature signature_id user_id vendor_product EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `powershell_download_from_code_hosting_service_filter`