Suspicious Invoke-WebRequest Execution to Sensitive Locations

Google SecOps@GoogleSecOps

•updated Jun 6, 2025•0•37

This rule detects suspicious execution of PowerShell's Invoke-WebRequest (or its aliases like 'iwr', 'curl', 'wget') when the output is directed to a suspicious location. Suspicious locations include common user directories like AppData, Desktop, Temp, Public, or the Windows directory, which are often abused by adversaries for dropping malicious files.