Windows PowerShell Directory Enumeration via Get-ChildItem and Output Redirection
Flags PowerShell directory enumeration patterns using Get-ChildItem, error suppression, and appended output to a file.
- Product
- windows
- Category
- ps_script
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-03-17
- Updated
- 2026-07-31
ATT&CK techniques
DiscoveryRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies PowerShell script block content that enumerates directories using Get-ChildItem with a -Path parameter, suppresses errors with SilentlyContinue, and writes results to a file via Out-File with -append. Attackers commonly enumerate filesystem structure to locate files for discovery, targeting, or staging prior to further actions. It relies on Script Block Logging telemetry that contains the script text elements used in the enumeration and output workflow.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1083/T1083.md
- mandiant.comhttps://www.mandiant.com/resources/tactics-techniques-procedures-associated-with-maze-ransomware-incidents
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_directory_enum.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows PowerShell Directory Enumeration via Get-ChildItem and Output Redirection
id: 3651204e-ed2c-4eeb-b460-0df0406e81dc
status: test
description: This rule identifies PowerShell script block content that enumerates directories using Get-ChildItem with a -Path parameter, suppresses errors with SilentlyContinue, and writes results to a file via Out-File with -append. Attackers commonly enumerate filesystem structure to locate files for discovery, targeting, or staging prior to further actions. It relies on Script Block Logging telemetry that contains the script text elements used in the enumeration and output workflow.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1083/T1083.md
- https://www.mandiant.com/resources/tactics-techniques-procedures-associated-with-maze-ransomware-incidents
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_directory_enum.yml
author: frack113, Huntrule Team
date: 2022-03-17
tags:
- attack.discovery
- attack.t1083
logsource:
product: windows
category: ps_script
definition: "Requirements: Script Block Logging must be enabled"
detection:
selection:
ScriptBlockText|contains|all:
- foreach
- Get-ChildItem
- "-Path "
- "-ErrorAction "
- SilentlyContinue
- "Out-File "
- -append
condition: selection
falsepositives:
- Legitimate PowerShell scripts
level: medium
license: DRL-1.1
related:
- id: 162e69a7-7981-4344-84a9-0f1c9a217a52
type: derived