PowerShell Credential Discovery via Recursive File Search and Select-String

Flags PowerShell script blocks that recursively list files and run select-string pattern searches, indicative of credential hunting.

FreeReviewedSigma · Medium · v2

Product: windows
Category: ps_script
Author: frack113 (SigmaHQ), DRL 1.1
Published: 2021-12-19
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Cred Access

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1552.001Credentials In Files
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags PowerShell script block activity that combines a recursive directory listing with pattern searching using select-string, consistent with discovering files that may contain sensitive data. Attackers often use this to locate locally stored or shared files holding credentials, configuration secrets, or other embedded sensitive strings. It relies on Windows PowerShell script block text telemetry, specifically Script Block Logging, to observe the presence of the involved cmdlet and parameters.

Reporting behind it

Related detections9 linkedT1552.001 — drag to rearrange

Suspicious UAT-10608 Hidden Credential Harvesting Script Execution via nohup

Suspicious Access to Cloud and Database Credential Files via Process

Suspicious Credential Exfiltration to webhook.site (via dns_query)

Suspicious Shai-Hulud Worm Stager Execution from Temp (via process_creation)

Suspicious prt-scan Campaign Credential Harvesting via proc environ Scan (via process_creation)

Possible Stolen AWS Credential Validation via STS GetCallerIdentity

Suspicious Double Base64 Decoded Payload Piped to Shell in CI (reviewdog Supply Chain)

Malicious Winlogon Automatic Logon Persistence via Registry AutoAdminLogon (via process_creation)

Suspicious RegAsm MSBuild or AutoIt Accessing Browser Credential Stores

PowerShell Credential Discovery via Recursive File Search and Select-String

Pivot detection · T1552.001 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

powershell-script-block-information-discovery-via-recursive-listing-and-credenti-bd5971a7

title: PowerShell Credential Discovery via Recursive File Search and Select-String
id: c9db7c2b-5fd9-4547-bed0-c05ca02175c5
status: test
description: This rule flags PowerShell script block activity that combines a recursive directory listing with pattern searching using select-string, consistent with discovering files that may contain sensitive data. Attackers often use this to locate locally stored or shared files holding credentials, configuration secrets, or other embedded sensitive strings. It relies on Windows PowerShell script block text telemetry, specifically Script Block Logging, to observe the presence of the involved cmdlet and parameters.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.001/T1552.001.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_extracting.yml
author: frack113, Huntrule Team
date: 2021-12-19
modified: 2022-12-25
tags:
  - attack.credential-access
  - attack.t1552.001
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains|all:
      - ls
      - " -R"
      - "select-string "
      - "-Pattern "
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: bd5971a7-626d-46ab-8176-ed643f694f68
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL