Suspicious Extracting Information with PowerShell (via ps_script)

title: Suspicious Extracting Information with PowerShell (via ps_script)
id: a7c97e4f-3e68-59c9-9c27-e7c903a74cda
status: stable
description: This rule detects threat actors may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
references:
    - https://attack.mitre.org/techniques/T1552/001/
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.001/T1552.001.md
author: Huntrule Team
date: 2026-05-03
tags:
    - attack.credential-access
    - attack.t1552.001
logsource:
    product: windows
    category: ps_script
    definition: 'Requirements: Script Block Logging must be enabled'
detection:
    selection:
        ScriptBlockText|contains|all:
            - ls
            - ' -R'
            - 'select-string '
            - '-Pattern '
    condition: selection
falsepositives:
    - Unknown
level: medium