Windows File Events: PowerShell Profile Script Creation or Modification

Alerts on creation or modification of PowerShell profile.ps1 files in typical Windows and PowerShell 7 locations.

FreeUnreviewedSigmamediumv1

windows-file-events-powershell-profile-script-creation-or-modification-b5b78988

title: "Windows File Events: PowerShell Profile Script Creation or Modification"
id: 93fc0d82-520a-4411-b739-0314dbc505a5
status: test
description: This rule flags file create or modify events for common PowerShell profile script paths on Windows, including Microsoft.PowerShell_profile.ps1 and profile.ps1 locations for Windows PowerShell and PowerShell 7. Attackers may abuse PowerShell profiles to establish persistence by loading malicious commands automatically when PowerShell starts. It relies on Windows file event telemetry that captures the affected filenames and their path suffixes.
references:
  - https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/
  - https://persistence-info.github.io/Data/powershellprofile.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_susp_powershell_profile.yml
author: HieuTT35, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2019-10-24
modified: 2023-10-23
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1546.013
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename|endswith:
      - \Microsoft.PowerShell_profile.ps1
      - \PowerShell\profile.ps1
      - \Program Files\PowerShell\7-preview\profile.ps1
      - \Program Files\PowerShell\7\profile.ps1
      - \Windows\System32\WindowsPowerShell\v1.0\profile.ps1
      - \WindowsPowerShell\profile.ps1
  condition: selection
falsepositives:
  - System administrator creating Powershell profile manually
level: medium
license: DRL-1.1
related:
  - id: b5b78988-486d-4a80-b991-930eff3ff8bf
    type: derived

What it detects

This rule flags file create or modify events for common PowerShell profile script paths on Windows, including Microsoft.PowerShell_profile.ps1 and profile.ps1 locations for Windows PowerShell and PowerShell 7. Attackers may abuse PowerShell profiles to establish persistence by loading malicious commands automatically when PowerShell starts. It relies on Windows file event telemetry that captures the affected filenames and their path suffixes.

Known false positives

System administrator creating Powershell profile manually

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.