huntrule

Windows PowerShell Profile File Creation or Modification

Alerts on creation or modification of PowerShell profile.ps1 files in typical Windows and PowerShell 7 locations.

FreeReviewedSigma · Medium · v2
Product
windows
Category
file_event
Author
HieuTT35, Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2019-10-24
Updated
2026-07-31
AnalysisDetection
title: Windows PowerShell Profile File Creation or Modification
id: 93fc0d82-520a-4411-b739-0314dbc505a5
status: test
description: This rule flags file events where key PowerShell profile scripts are created or modified on Windows. Attackers may change these profile files to enable persistence by ensuring their code runs automatically in future PowerShell sessions. The detection relies on Windows file event telemetry that includes the modified/created target filename paths matching common PowerShell profile locations.
references:
  - https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/
  - https://persistence-info.github.io/Data/powershellprofile.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_susp_powershell_profile.yml
author: HieuTT35, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2019-10-24
modified: 2023-10-23
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1546.013
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename|endswith:
      - \Microsoft.PowerShell_profile.ps1
      - \PowerShell\profile.ps1
      - \Program Files\PowerShell\7-preview\profile.ps1
      - \Program Files\PowerShell\7\profile.ps1
      - \Windows\System32\WindowsPowerShell\v1.0\profile.ps1
      - \WindowsPowerShell\profile.ps1
  condition: selection
falsepositives:
  - System administrator creating Powershell profile manually
level: medium
license: DRL-1.1
related:
  - id: b5b78988-486d-4a80-b991-930eff3ff8bf
    type: derived