Windows PowerShell Directory Enumeration via Get-ChildItem Script Block

Flags PowerShell directory enumeration patterns using Get-ChildItem, error suppression, and appended output to a file.

FreeUnreviewedSigmamediumv1

windows-powershell-directory-enumeration-via-get-childitem-script-block-162e69a7

title: Windows PowerShell Directory Enumeration via Get-ChildItem Script Block
id: 3651204e-ed2c-4eeb-b460-0df0406e81dc
status: test
description: This rule identifies PowerShell script blocks that enumerate directories using Get-ChildItem with parameters that include a target path, suppressing errors (SilentlyContinue), and writing results to a file using Out-File with append. Attackers frequently use this discovery step to map accessible filesystem locations before further actions. The detection relies on Script Block Logging telemetry capturing the script text content.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1083/T1083.md
  - https://www.mandiant.com/resources/tactics-techniques-procedures-associated-with-maze-ransomware-incidents
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_directory_enum.yml
author: frack113, Huntrule Team
date: 2022-03-17
tags:
  - attack.discovery
  - attack.t1083
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains|all:
      - foreach
      - Get-ChildItem
      - "-Path "
      - "-ErrorAction "
      - SilentlyContinue
      - "Out-File "
      - -append
  condition: selection
falsepositives:
  - Legitimate PowerShell scripts
level: medium
license: DRL-1.1
related:
  - id: 162e69a7-7981-4344-84a9-0f1c9a217a52
    type: derived

What it detects

This rule identifies PowerShell script blocks that enumerate directories using Get-ChildItem with parameters that include a target path, suppressing errors (SilentlyContinue), and writing results to a file using Out-File with append. Attackers frequently use this discovery step to map accessible filesystem locations before further actions. The detection relies on Script Block Logging telemetry capturing the script text content.

Known false positives

Legitimate PowerShell scripts

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.