PowerShell discovery of Win32_PnPEntity via ScriptBlockText
Alerts when PowerShell script blocks reference Win32_PnPEntity to enumerate attached Plug and Play devices.
- Product
- windows
- Category
- ps_script
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2021-08-23
- Updated
- 2026-07-31
ATT&CK techniques
DiscoveryRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags PowerShell activity whose script block text includes the Win32_PnPEntity class, indicating possible discovery of attached hardware/peripheral device information. Attackers often use WMI/CIM queries during reconnaissance to identify connected components and tailor subsequent actions. The detection relies on Script Block Logging telemetry capturing the PowerShell script content, matching the presence of the Win32_PnPEntity string.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: PowerShell discovery of Win32_PnPEntity via ScriptBlockText
id: d8c93bd8-35cc-495c-b258-abb60e24a9f7
status: test
description: This rule flags PowerShell activity whose script block text includes the Win32_PnPEntity class, indicating possible discovery of attached hardware/peripheral device information. Attackers often use WMI/CIM queries during reconnaissance to identify connected components and tailor subsequent actions. The detection relies on Script Block Logging telemetry capturing the PowerShell script content, matching the presence of the Win32_PnPEntity string.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1120/T1120.md
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_win32_pnpentity.yml
author: frack113, Huntrule Team
date: 2021-08-23
modified: 2022-12-25
tags:
- attack.discovery
- attack.t1120
logsource:
product: windows
category: ps_script
definition: "Requirements: Script Block Logging must be enabled"
detection:
selection:
ScriptBlockText|contains: Win32_PnPEntity
condition: selection
falsepositives:
- Admin script
level: low
license: DRL-1.1
related:
- id: b26647de-4feb-4283-af6b-6117661283c5
type: derived