Suspicious PowerShell Execution with Public IPv4

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects PowerShell making web requests directly to public IPv4 addresses using Invoke-WebRequest or Invoke-RestMethod, which may indicate suspicious activity. Threat actors may use this technique to download and execute secondary payloads from direct IP addresses, potentially their command and control (C2) servers or other malicious infrastructure.

2026-01-29 00:00:00

None

4de5b8f6-3a2d-4d25-8bfd-1e3c427c687d

attack.execution attack.t1059.001 attack.command-and-control attack.t1105

Nextron Sigma feed only (private)