Windows PowerShell creating executable or script files matching binary dropper patterns

Alerts when PowerShell writes .exe/.dll or script-like files, consistent with binary/script staging or dropping.

FreeUnreviewedSigmamediumv1

windows-powershell-creating-executable-or-script-files-matching-binary-dropper-p-7047d730

title: Windows PowerShell creating executable or script files matching binary dropper patterns
id: e0f1c3fd-79df-4b9c-9638-67ee5107cc8d
status: test
description: This rule flags Windows PowerShell processes (powershell.exe, powershell_ise.exe, pwsh.exe) writing files whose names end with common executable or script extensions. Attackers commonly use PowerShell to stage payloads by dropping binaries or script-based components into user or system paths. It relies on Windows file creation events, matching the process image and target filename patterns, while excluding several common temporary/module/package locations to reduce noise.
references:
  - https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_powershell_drop_binary_or_script.yml
author: frack113, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-03-17
modified: 2025-07-04
tags:
  - attack.persistence
logsource:
  product: windows
  category: file_event
detection:
  selection:
    Image|endswith:
      - \powershell.exe
      - \powershell_ise.exe
      - \pwsh.exe
    TargetFilename|endswith:
      - .bat
      - .chm
      - .cmd
      - .com
      - .dll
      - .exe
      - .hta
      - .jar
      - .js
      - .ocx
      - .scr
      - .sys
      - .vbe
      - .vbs
      - .wsf
  filter_main_user_temp:
    TargetFilename|startswith: C:\Users\
    TargetFilename|contains: \AppData\Local\Temp\
    TargetFilename|endswith:
      - .dll
      - .exe
  filter_main_other_temp:
    TargetFilename|startswith:
      - C:\Windows\Temp\
      - C:\Windows\SystemTemp\
    TargetFilename|endswith:
      - .dll
      - .exe
  filter_main_powershell_module:
    TargetFilename|startswith: C:\Users\
    TargetFilename|contains: \WindowsPowerShell\Modules\
    TargetFilename|endswith: .dll
  filter_main_nuget:
    TargetFilename|startswith: C:\Program Files\PackageManagement\ProviderAssemblies\nuget\
    TargetFilename|endswith: \Microsoft.PackageManagement.NuGetProvider.dll
  condition: selection and not 1 of filter_main_*
falsepositives:
  - False positives will differ depending on the environment and scripts used. Apply additional filters accordingly.
level: medium
license: DRL-1.1
related:
  - id: 7047d730-036f-4f40-b9d8-1c63e36d5e62
    type: derived

What it detects

This rule flags Windows PowerShell processes (powershell.exe, powershell_ise.exe, pwsh.exe) writing files whose names end with common executable or script extensions. Attackers commonly use PowerShell to stage payloads by dropping binaries or script-based components into user or system paths. It relies on Windows file creation events, matching the process image and target filename patterns, while excluding several common temporary/module/package locations to reduce noise.

Known false positives

False positives will differ depending on the environment and scripts used. Apply additional filters accordingly.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.