PowerShell Copies or Installs DLLs into Windows System32 or SysWOW64

title: PowerShell Copies or Installs DLLs into Windows System32 or SysWOW64
id: 0fc2ca50-bd18-4a37-8612-fd8dfa2212e9
status: test
description: This rule matches PowerShell script content where Copy-Item (or cpi) writes a file to a Windows system directory path, specifically Windows\System32 or Windows\SysWOW64. Attackers may use this to place malicious DLLs in locations commonly used for loading and persistence or to impair defenses by redirecting functionality. It relies on PowerShell script block telemetry capturing the script text that includes the copy/install command and destination path.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1556.002/T1556.002.md#atomic-test-1---install-and-register-password-filter-dll
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_copy_item_system_directory.yml
author: frack113, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2021-12-27
modified: 2024-01-22
tags:
  - attack.persistence
  - attack.credential-access
  - attack.defense-impairment
  - attack.t1556.002
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|re: (Copy-Item|cpi) .{2,128} -Destination .{1,32}\\Windows\\(System32|SysWOW64)
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 63bf8794-9917-45bc-88dd-e1b5abc0ecfd
    type: derived