name: Windows Powershell DownloadString
id: e4a2cc58-59d4-480a-8992-9dfb95a4bacd
version: 1
date: '2024-03-19'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic identifies the use of PowerShell downloading a
  file using `DownloadString` method. This particular method is utilized in many different
  PowerShell frameworks to download files and output to disk. Identify the source
  (IP/domain) and destination file and triage appropriately. If AMSI logging or PowerShell
  transaction logs are available, review for further details of the implant.
data_source:
- Windows Security 4688
search: 
  selection1:
    process.file.name:
    - powershell_ise.exe
    - powershell.exe
    - sqltoolsps.exe
    - sqlps.exe
    - pwsh.exe
    - pwsh.exe
  selection2:
    process.cmd_line|re: DownloadString
  condition: selection1 and selection2
how_to_implement: The detection is based on data that originates from Endpoint Detection
  and Response (EDR) agents. These agents are designed to provide security-related
  telemetry from the endpoints where the agent is installed. To implement this search,
  you must ingest logs that contain the process GUID, process name, and parent process.
  Additionally, you must ingest complete command-line executions. These logs must
  be processed using the appropriate Splunk Technology Add-ons that are specific to
  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
  data model. Use the Splunk Common Information Model (CIM) to normalize the field
  names and speed up the data modeling process.
known_false_positives: False positives may be present and filtering will need to occur
  by parent process or command line argument. It may be required to modify this query
  to an EDR product for more granular coverage.
references:
- https://docs.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadstring?view=net-5.0
- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md
- https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/
tags:
  analytic_story:
  - Winter Vivern
  - Ingress Tool Transfer
  - Hermetic Wiper
  - Malicious PowerShell
  - HAFNIUM Group
  - Data Destruction
  - IcedID
  - SysAid On-Prem Software CVE-2023-47246 Vulnerability
  asset_type: Endpoint
  confidence: 70
  impact: 80
  message: An instance of $parent_process_name$ spawning $process_name$ was identified
    on endpoint $dest$ by user $user$. This behavior identifies the use of DownloadString
    within PowerShell.
  mitre_attack_id:
  - T1059
  - T1059.001
  - T1105
  observable: []
  product:
  - Splunk Behavioral Analytics
  required_fields: []
  risk_score: 56
  security_domain: endpoint
tests:
- name: True Positive Test
  attack_data:
  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/windows-security-2.log
    source: XmlWinEventLog:Security
    sourcetype: XmlWinEventLog