Windows PowerShell Profile File Creation or Modification
Alerts on creation or modification of PowerShell profile.ps1 files in typical Windows and PowerShell 7 locations.
- Product
- windows
- Category
- file_event
- Author
- HieuTT35, Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2019-10-24
- Updated
- 2026-07-31
ATT&CK techniques
Persistence → Priv EscRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags file events where key PowerShell profile scripts are created or modified on Windows. Attackers may change these profile files to enable persistence by ensuring their code runs automatically in future PowerShell sessions. The detection relies on Windows file event telemetry that includes the modified/created target filename paths matching common PowerShell profile locations.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows PowerShell Profile File Creation or Modification
id: 93fc0d82-520a-4411-b739-0314dbc505a5
status: test
description: This rule flags file events where key PowerShell profile scripts are created or modified on Windows. Attackers may change these profile files to enable persistence by ensuring their code runs automatically in future PowerShell sessions. The detection relies on Windows file event telemetry that includes the modified/created target filename paths matching common PowerShell profile locations.
references:
- https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/
- https://persistence-info.github.io/Data/powershellprofile.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_susp_powershell_profile.yml
author: HieuTT35, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2019-10-24
modified: 2023-10-23
tags:
- attack.persistence
- attack.privilege-escalation
- attack.t1546.013
logsource:
product: windows
category: file_event
detection:
selection:
TargetFilename|endswith:
- \Microsoft.PowerShell_profile.ps1
- \PowerShell\profile.ps1
- \Program Files\PowerShell\7-preview\profile.ps1
- \Program Files\PowerShell\7\profile.ps1
- \Windows\System32\WindowsPowerShell\v1.0\profile.ps1
- \WindowsPowerShell\profile.ps1
condition: selection
falsepositives:
- System administrator creating Powershell profile manually
level: medium
license: DRL-1.1
related:
- id: b5b78988-486d-4a80-b991-930eff3ff8bf
type: derived