Outbound HTTP GET for shell.ps1 second-stage PowerShell payload

Ibrahim Saud@tektrix

•updated 13 days ago•0•0•2

This rule detects outbound HTTP GET requests initiated by a process using a 'WebClient' user-agent to retrieve a file named 'shell.ps1'. This behavior is characteristic of adversaries downloading second-stage PowerShell payloads to a compromised host.