PowerShell Script Block: Get-ChildItem Recursive Bookmark Collection from Browser Paths

Detects PowerShell Get-ChildItem activity used to recursively enumerate browser bookmarks from a target path.

FreeUnreviewedSigmalowv1

powershell-script-block-get-childitem-recursive-bookmark-collection-from-browser-e0565f5d

title: "PowerShell Script Block: Get-ChildItem Recursive Bookmark Collection from Browser Paths"
id: ebf61ae9-38ec-4e47-b497-00dd5dee5f53
status: test
description: This rule flags PowerShell script block activity that calls Get-ChildItem with parameters consistent with recursively enumerating bookmark files from a path using a Bookmarks filter. Automated collection of browser-stored bookmarks can help an attacker profile the user and identify potentially sensitive or internal-facing resources referenced by the system. The detection relies on Script Block Logging telemetry that records the executed PowerShell script text matching the required command fragments.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1217/T1217.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_get_childitem_bookmarks.yml
author: frack113, Huntrule Team
date: 2021-12-13
modified: 2022-12-25
tags:
  - attack.discovery
  - attack.t1217
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains|all:
      - Get-ChildItem
      - " -Recurse "
      - " -Path "
      - " -Filter Bookmarks"
      - " -ErrorAction SilentlyContinue"
      - " -Force"
  condition: selection
falsepositives:
  - Unknown
level: low
license: DRL-1.1
related:
  - id: e0565f5d-d420-4e02-8a68-ac00d864f9cf
    type: derived

What it detects

This rule flags PowerShell script block activity that calls Get-ChildItem with parameters consistent with recursively enumerating bookmark files from a path using a Bookmarks filter. Automated collection of browser-stored bookmarks can help an attacker profile the user and identify potentially sensitive or internal-facing resources referenced by the system. The detection relies on Script Block Logging telemetry that records the executed PowerShell script text matching the required command fragments.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.