Windows PowerShell File Dropper Activity: Creating Executables or Script Files
Alerts when PowerShell writes .exe/.dll or script-like files, consistent with binary/script staging or dropping.
FreeReviewedSigma · Medium · v2
- Product
- windows
- Category
- file_event
- Author
- frack113, Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-03-17
- Updated
- 2026-07-31
What it detects
This rule flags Windows PowerShell (powershell.exe, powershell_ise.exe, or pwsh.exe) creating files whose names end with common executable and script extensions. Such behavior can indicate an attacker staging payloads by dropping binaries or scripts for execution or persistence. The detection relies on file creation events with process image path matching and target filename suffix patterns, with several common development and temporary-path exclusions applied.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-powershell-creating-executable-or-script-files-matching-binary-dropper-p-7047d730
title: "Windows PowerShell File Dropper Activity: Creating Executables or Script Files"
id: e0f1c3fd-79df-4b9c-9638-67ee5107cc8d
status: test
description: This rule flags Windows PowerShell (powershell.exe, powershell_ise.exe, or pwsh.exe) creating files whose names end with common executable and script extensions. Such behavior can indicate an attacker staging payloads by dropping binaries or scripts for execution or persistence. The detection relies on file creation events with process image path matching and target filename suffix patterns, with several common development and temporary-path exclusions applied.
references:
- https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_powershell_drop_binary_or_script.yml
author: frack113, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-03-17
modified: 2025-07-04
tags:
- attack.persistence
logsource:
product: windows
category: file_event
detection:
selection:
Image|endswith:
- \powershell.exe
- \powershell_ise.exe
- \pwsh.exe
TargetFilename|endswith:
- .bat
- .chm
- .cmd
- .com
- .dll
- .exe
- .hta
- .jar
- .js
- .ocx
- .scr
- .sys
- .vbe
- .vbs
- .wsf
filter_main_user_temp:
TargetFilename|startswith: C:\Users\
TargetFilename|contains: \AppData\Local\Temp\
TargetFilename|endswith:
- .dll
- .exe
filter_main_other_temp:
TargetFilename|startswith:
- C:\Windows\Temp\
- C:\Windows\SystemTemp\
TargetFilename|endswith:
- .dll
- .exe
filter_main_powershell_module:
TargetFilename|startswith: C:\Users\
TargetFilename|contains: \WindowsPowerShell\Modules\
TargetFilename|endswith: .dll
filter_main_nuget:
TargetFilename|startswith: C:\Program Files\PackageManagement\ProviderAssemblies\nuget\
TargetFilename|endswith: \Microsoft.PackageManagement.NuGetProvider.dll
condition: selection and not 1 of filter_main_*
falsepositives:
- False positives will differ depending on the environment and scripts used. Apply additional filters accordingly.
level: medium
license: DRL-1.1
related:
- id: 7047d730-036f-4f40-b9d8-1c63e36d5e62
type: derived