PowerShell Recon via Script Blocks: Service, Processes, and Temp Directory Access

Detects PowerShell script blocks performing recon queries (services/processes) and writing output to TEMP.

FreeUnreviewedSigmamediumv1

powershell-recon-via-script-blocks-service-processes-and-temp-directory-access-a9723fcc

title: "PowerShell Recon via Script Blocks: Service, Processes, and Temp Directory Access"
id: 71ef2291-c511-415b-ab11-250345dbe0e6
status: test
description: This rule flags PowerShell script block content indicative of local reconnaissance by searching for commands that query Windows services, enumerate child items, and list processes. It also matches script blocks that redirect output to a path under the TEMP directory, a common step when staging collected information. The detection relies on Windows PowerShell Script Block Logging telemetry, specifically the ScriptBlockText content.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1119/T1119.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_recon_export.yml
author: frack113, Huntrule Team
date: 2021-07-30
modified: 2022-12-25
tags:
  - attack.collection
  - attack.t1119
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection_action:
    ScriptBlockText|contains:
      - "Get-Service "
      - "Get-ChildItem "
      - "Get-Process "
  selection_redirect:
    ScriptBlockText|contains: "> $env:TEMP\\"
  condition: all of selection*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: a9723fcc-881c-424c-8709-fd61442ab3c3
    type: derived

What it detects

This rule flags PowerShell script block content indicative of local reconnaissance by searching for commands that query Windows services, enumerate child items, and list processes. It also matches script blocks that redirect output to a path under the TEMP directory, a common step when staging collected information. The detection relies on Windows PowerShell Script Block Logging telemetry, specifically the ScriptBlockText content.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.