Windows PowerShell Recon via Export-Oriented Commands in Script Block Logging
Detects PowerShell script blocks performing recon queries (services/processes) and writing output to TEMP.
- Product
- windows
- Category
- ps_script
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2021-07-30
- Updated
- 2026-07-31
ATT&CK techniques
CollectionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies PowerShell script block content that includes service, filesystem, and process discovery activity along with evidence of redirecting output to a temporary path under %TEMP%. Such collection behavior can be used to inventory internal assets and prepare data for later export or analysis by an attacker. It relies on Script Block Logging telemetry capturing ScriptBlockText and matching specific command and redirection patterns.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows PowerShell Recon via Export-Oriented Commands in Script Block Logging
id: 71ef2291-c511-415b-ab11-250345dbe0e6
status: test
description: This rule identifies PowerShell script block content that includes service, filesystem, and process discovery activity along with evidence of redirecting output to a temporary path under %TEMP%. Such collection behavior can be used to inventory internal assets and prepare data for later export or analysis by an attacker. It relies on Script Block Logging telemetry capturing ScriptBlockText and matching specific command and redirection patterns.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1119/T1119.md
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_recon_export.yml
author: frack113, Huntrule Team
date: 2021-07-30
modified: 2022-12-25
tags:
- attack.collection
- attack.t1119
logsource:
product: windows
category: ps_script
definition: "Requirements: Script Block Logging must be enabled"
detection:
selection_action:
ScriptBlockText|contains:
- "Get-Service "
- "Get-ChildItem "
- "Get-Process "
selection_redirect:
ScriptBlockText|contains: "> $env:TEMP\\"
condition: all of selection*
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: a9723fcc-881c-424c-8709-fd61442ab3c3
type: derived