Possible Binary Or Script Dropper Through PowerShell (via file_event)

title: Possible Binary Or Script Dropper Through PowerShell (via file_event)
id: 6f3a4215-d418-55dd-9a3e-fec2f3baa52b
status: stable
description: This rule detects PowerShell creating a binary executable or a script file.
references:
    - https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
author: Huntrule Team
date: 2026-06-06
tags:
    - attack.persistence
    - attack.execution
    - attack.t1059.001
logsource:
    product: windows
    category: file_event
detection:
    selection:
        Image|endswith:
            - '\powershell.exe'
            - '\powershell_ise.exe'
            - '\pwsh.exe'
        TargetFilename|endswith:
            - '.bat'
            - '.chm'
            - '.cmd'
            - '.com'
            - '.dll'
            - '.exe'
            - '.hta'
            - '.jar'
            - '.js'
            - '.ocx'
            - '.scr'
            - '.sys'
            - '.vbe'
            - '.vbs'
            - '.wsf'
    filter_main_user_temp:
        TargetFilename|startswith: 'C:\Users\'
        TargetFilename|contains: '\AppData\Local\Temp\'
        TargetFilename|endswith:
            - '.dll'
            - '.exe'
    filter_main_other_temp:
        TargetFilename|startswith:
            - 'C:\Windows\Temp\'
            - 'C:\Windows\SystemTemp\'
        TargetFilename|endswith:
            - '.dll'
            - '.exe'
    filter_main_powershell_module:
        TargetFilename|startswith: 'C:\Users\'
        TargetFilename|contains: '\WindowsPowerShell\Modules\'
        TargetFilename|endswith: '.dll'
    filter_main_nuget:
        TargetFilename|startswith: 'C:\Program Files\PackageManagement\ProviderAssemblies\nuget\'
        TargetFilename|endswith: '\Microsoft.PackageManagement.NuGetProvider.dll'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unknown
level: medium