huntrule

Suspicious PS1Bot PowerShell Payload Written to ProgramData (via file_event)

PremiumReviewedSigma · High · v1
Product
windows
Category
file_event
Author
HuntRule
Published
2026-09-10
Updated
2026-09-10
AnalysisDetection

ATT&CK techniques

Execution → Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects the PS1Bot malware framework writing its PowerShell payload ntu.ps1 into the ProgramData directory. PS1Bot is delivered through malvertising and stages obfuscated PowerShell modules from this location for in-memory execution. Script files created in ProgramData outside of installer activity are a strong indicator of staging.

Reporting behind it

Related detections9 linkedT1027 — drag to rearrange
Suspicious In-Memory Runspace Execution via PowerShell Script Block
Suspicious Encoded PowerShell Using Base64 Stream Decompression Routines (via process_creation)
Suspicious PowerShell In-Memory Execution with AES Decryption
Suspicious Encoded PowerShell Command Execution
Suspicious PEAKLIGHT Memory-Only PowerShell Downloader Flags (via process_creation)
Obfuscated PowerShell Script: Indirect Cmdlet Execution via ExportedCommands Array Index
Suspicious PowerShell String Concatenation Obfuscation for Batch Extension via LNK (via process_creation)
Suspicious PowerShell Spawned from PyInstaller MEI Extraction Folder (via process_creation)
Suspicious PowerShell Encoded Command Execution
Suspicious PS1Bot PowerShell Payload Written to ProgramData (via file_event)
Pivot detection · T1027 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.