PowerShell Script Block Information Discovery via Recursive Listing and Credential Search

Flags PowerShell script blocks that recursively list files and run select-string pattern searches, indicative of credential hunting.

FreeUnreviewedSigmamediumv1

powershell-script-block-information-discovery-via-recursive-listing-and-credenti-bd5971a7

title: PowerShell Script Block Information Discovery via Recursive Listing and Credential Search
id: c9db7c2b-5fd9-4547-bed0-c05ca02175c5
status: test
description: This rule identifies PowerShell script block activity that performs recursive directory listing and uses string matching with select-string, consistent with searching files for sensitive content such as stored credentials. Attackers commonly use PowerShell to enumerate local drives and file shares and then scan results for patterns that indicate secrets. The detection relies on Script Block Logging telemetry capturing the exact script text executed by PowerShell.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.001/T1552.001.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_extracting.yml
author: frack113, Huntrule Team
date: 2021-12-19
modified: 2022-12-25
tags:
  - attack.credential-access
  - attack.t1552.001
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains|all:
      - ls
      - " -R"
      - "select-string "
      - "-Pattern "
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: bd5971a7-626d-46ab-8176-ed643f694f68
    type: derived

What it detects

This rule identifies PowerShell script block activity that performs recursive directory listing and uses string matching with select-string, consistent with searching files for sensitive content such as stored credentials. Attackers commonly use PowerShell to enumerate local drives and file shares and then scan results for patterns that indicate secrets. The detection relies on Script Block Logging telemetry capturing the exact script text executed by PowerShell.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.