PowerShell Automated File Collection Using Get-ChildItem with Recursive Include Filters (Windows)

Alerts on PowerShell file enumeration that recursively searches and includes common document extensions via Get-ChildItem.

FreeUnreviewedSigmamediumv1

powershell-automated-file-collection-using-get-childitem-with-recursive-include--c1dda054

title: PowerShell Automated File Collection Using Get-ChildItem with Recursive Include Filters (Windows)
id: a1bf4226-f394-43e6-b624-d78284dba6d1
status: test
description: This rule flags PowerShell script block activity that combines a recursive Get-ChildItem call with an -Include list targeting common document, spreadsheet, presentation, and text file extensions. Attackers often use this pattern to quickly enumerate and collect sensitive internal files once they have execution within a system or network. It relies on Script Block Logging telemetry to capture the ScriptBlockText contents containing both the recursive enumeration and the targeted file extensions.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1119/T1119.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_automated_collection.yml
author: frack113, Huntrule Team
date: 2021-07-28
modified: 2022-12-25
tags:
  - attack.collection
  - attack.t1119
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection_ext:
    ScriptBlockText|contains:
      - .doc
      - .docx
      - .xls
      - .xlsx
      - .ppt
      - .pptx
      - .rtf
      - .pdf
      - .txt
  selection_cmd:
    ScriptBlockText|contains|all:
      - Get-ChildItem
      - " -Recurse "
      - " -Include "
  condition: all of selection*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: c1dda054-d638-4c16-afc8-53e007f3fbc5
    type: derived

What it detects

This rule flags PowerShell script block activity that combines a recursive Get-ChildItem call with an -Include list targeting common document, spreadsheet, presentation, and text file extensions. Attackers often use this pattern to quickly enumerate and collect sensitive internal files once they have execution within a system or network. It relies on Script Block Logging telemetry to capture the ScriptBlockText contents containing both the recursive enumeration and the targeted file extensions.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.