[[ fm.text ]] Click here

PowerShell web download spawning suspicious child process (CVE-2025-54100)

SIGMA detection rule by Adama ASSIONGBON (SOC & CTI Consultant), https://linkedin.com/in/adama-assiongbon-9029893a · Apache-2.0

Detects PowerShell with web download spawning a suspicious child process. STRICT indicator of CVE-2025-54100 post-EoP stager activity.

title: PowerShell web download spawning suspicious child process (CVE-2025-54100)
id: 2b51c3c7-ba03-47a3-8354-d18cc83aacf6
status: experimental
description: |
  Detects PowerShell with web download spawning a suspicious child process. STRICT indicator of CVE-2025-54100 post-EoP stager activity. SOC L1 should verify the source, affected host, user, process or request fields, timing, and related activity.
  Détecte PowerShell téléchargeant du contenu web puis lançant un processus enfant suspect. Indicateur haute confiance d'activité post-exploitation liée à CVE-2025-54100. Les stagers post-EoP tournent souvent sous SYSTEM ; les filtres SYSTEM sont intentionnellement absents. Règle STRICT : les trois conditions (parent PS + indicateur download + enfant LOLBin) doivent être réunies simultanément. Le SOC L1 doit vérifier la source, l’hôte affecté, l’utilisateur, les champs de processus ou de requête, la chronologie et les activités associées.
related:
  - id: c04f0616-4205-416c-884b-8b2d0c958603
    type: similar

author: Adama ASSIONGBON (SOC & CTI Consultant), https://linkedin.com/in/adama-assiongbon-9029893a
date: '2025-12-22'
modified: 2026-06-22
references:
  - https://www.cve.org/CVERecord?id=CVE-2025-54100
  - https://nvd.nist.gov/vuln/detail/CVE-2025-54100
  - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-54100
  - https://github.com/ThemeHackers/CVE-2025-54100
tags:
  - attack.execution
  - attack.privilege-escalation
  - attack.t1059.001
  - attack.t1105
  - attack.t1204.002
  - cve.2025-54100
logsource:
  product: windows
  category: process_creation
detection:
  selection_parent_powershell:
    ParentImage|endswith:
      - \powershell.exe
      - \pwsh.exe

  selection_parent_download:
    ParentCommandLine|contains:
      - 'Invoke-WebRequest'
      - ' iwr '
      - 'DownloadFile'
      - 'DownloadString'
      - 'DownloadData'
      - 'Net.WebClient'
      - 'System.Net.WebClient'
      - '-Uri '
      - '-OutFile '

  selection_child_suspicious:
    Image|endswith:
      - \cmd.exe
      - \powershell.exe
      - \pwsh.exe
      - \rundll32.exe
      - \regsvr32.exe
      - \mshta.exe
      - \wscript.exe
      - \cscript.exe
      - \certutil.exe
      - \bitsadmin.exe
      - \msiexec.exe

  # Legitimate PowerShell administrative commands, narrow filter by CLI pattern only
  # User=SYSTEM INTENTIONALLY REMOVED: post-EoP payloads run under SYSTEM
  # Program Files filter INTENTIONALLY REMOVED: attackers can abuse binaries in that path
  filter_legitimate:
    ParentCommandLine|contains|all:
      - '-Help'
      - 'Get-'

  filter_ps_admin_commands:
    ParentCommandLine|startswith:
      - 'powershell -Command "Get-'
      - 'pwsh -Command "Get-'

  # SECOND CHALLENGE 2026-06-22: the previous filter matched any ParentCommandLine containing
  # 'WindowsPowerShell\v1.0\Modules\' regardless of drive or root path. An attacker can create
  # the directory C:\Users\victim\AppData\Roaming\WindowsPowerShell\v1.0\Modules\ and drop a
  # stager there, bypassing the filter. Narrowed to system-rooted module paths only.
  filter_ps_module_paths:
    ParentCommandLine|contains:
      - 'C:\Windows\System32\WindowsPowerShell\v1.0\Modules\'
      - 'C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\'
      - 'C:\Program Files\WindowsPowerShell\Modules\'
      - 'C:\Program Files (x86)\WindowsPowerShell\Modules\'

  filter_explicit_update_verbs:
    ParentCommandLine|contains:
      - 'Update-Module '
      - 'Update-Help '
      - 'Update-Script '
      - 'Install-Module '
      - 'Install-Script '
      - 'Install-Package '

  condition:
    selection_parent_powershell
    and selection_parent_download
    and selection_child_suspicious
    and not (filter_legitimate or filter_ps_admin_commands or filter_ps_module_paths or filter_explicit_update_verbs)

fields:
  - Image
  - CommandLine
  - ParentImage
  - ParentCommandLine
  - User
  - IntegrityLevel
  - CurrentDirectory

falsepositives:
  - Software deployment tools (SCCM, Intune, PDQ Deploy), filter by ParentCommandLine pattern
  - Legitimate administrative scripts with proper change control
  - Development/build pipelines downloading and executing code
  - Security tools performing authorized remote operations
  - SYSTEM-context matches warrant investigation, not exclusion

level: high

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

c87bfe7f-4ed0-4511-bd3c-890df0105da8

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion