Suspicious PowerShell Execution with Public IPv4 - PowerShell

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects PowerShell commands or scripts making web requests directly to public IPv4 addresses using `Invoke-WebRequest` or `Invoke-RestMethod`, which may indicate suspicious activity. Threat actors may use this technique to download and execute secondary payloads from direct IP addresses, potentially their command and control (C2) servers or other malicious infrastructure.

2026-01-29 00:00:00

None

fb4fcb88-6c88-48fe-8e70-4a6a6feb43cb

attack.execution attack.t1059.001 attack.command-and-control attack.t1105

Nextron Sigma feed only (private)