name: PowerShell WebRequest Using Memory Stream
id: 103affa6-924a-4b53-aff4-1d5075342aab
version: 2
date: '2024-05-12'
author: Steven Dick
status: production
type: TTP
description: The following analytic detects the use of .NET classes in PowerShell
  to download a URL payload directly into memory, a common fileless malware staging
  technique. It leverages PowerShell Script Block Logging (EventCode=4104) to identify
  suspicious PowerShell commands involving `system.net.webclient`, `system.net.webrequest`,
  and `IO.MemoryStream`. This activity is significant as it indicates potential fileless
  malware execution, which is harder to detect and can bypass traditional file-based
  defenses. If confirmed malicious, this technique could allow attackers to execute
  code in memory, evade detection, and maintain persistence in the environment.
data_source:
- Powershell Script Block Logging 4104
search: '`powershell` EventCode=4104  ScriptBlockText IN ("*system.net.webclient*","*system.net.webrequest*")
  AND ScriptBlockText="*IO.MemoryStream*" | eval Path = case(isnotnull(Path),Path,true(),"unknown")
  | stats count min(_time) as firstTime max(_time) as lastTime list(ScriptBlockText)
  as command values(Path) as file_name values(UserID) as user by ActivityID, Computer,
  EventCode | rename Computer as dest, EventCode as signature_id | `security_content_ctime(firstTime)`
  | `security_content_ctime(lastTime)` | `powershell_webrequest_using_memory_stream_filter`'
how_to_implement: The following analytic requires PowerShell operational logs to be
  imported. Modify the powershell macro as needed to match the sourcetype or add index.
  This analytic is specific to 4104, or PowerShell Script Block Logging.
known_false_positives: Unknown, possible custom scripting.
references:
- https://www.mandiant.com/resources/blog/tracking-evolution-gootloader-operations
- https://thedfirreport.com/2022/05/09/seo-poisoning-a-gootloader-story/
- https://attack.mitre.org/techniques/T1059/001/
tags:
  analytic_story:
  - Malicious PowerShell
  - MoonPeak
  asset_type: Endpoint
  confidence: 80
  impact: 100
  message: Powershell webrequest to memory stream behavior. Possible fileless malware
    staging on $dest$ by $user$.
  mitre_attack_id:
  - T1059.001
  - T1105
  - T1027.011
  observable:
  - name: dest
    type: Endpoint
    role:
    - Victim
  - name: user
    type: User
    role:
    - Victim
  - name: file_name
    type: File Name
    role:
    - Attacker
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - EventCode
  - ActivityID
  - Computer
  - ScriptBlockText
  risk_score: 80
  security_domain: endpoint
tests:
- name: True Positive Test
  attack_data:
  - data: 
      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/gootloader/partial_ttps/windows-powershell-xml.log
    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
    sourcetype: XmlWinEventLog