Windows File Writes Indicating Interactive PowerShell History as SYSTEM

title: Windows File Writes Indicating Interactive PowerShell History as SYSTEM
id: 38db6d55-7ba0-47dc-b791-2b7b58efb027
status: test
description: This rule flags file creation events consistent with interactive PowerShell activity occurring in the SYSTEM user context. Attackers may use SYSTEM to run privileged PowerShell sessions and leave traces such as PSReadLine console history or interactive startup profile data. The detection relies on Windows file event telemetry for the specific PowerShell history and interactive startup-related file paths created under the system profile.
references:
  - https://jpcertcc.github.io/ToolAnalysisResultSheet/details/PowerSploit_Invoke-Mimikatz.htm
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_susp_system_interactive_powershell.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-12-07
modified: 2022-08-13
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename:
      - C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
      - C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
  condition: selection
falsepositives:
  - Administrative activity
  - PowerShell scripts running as SYSTEM user
level: high
license: DRL-1.1
related:
  - id: 5b40a734-99b6-4b98-a1d0-1cea51a08ab2
    type: derived