huntrule

Windows: PowerShell Module File Creation by Non-PowerShell Process

Detects new PowerShell module files written into Modules directories by processes other than expected PowerShell hosts.

FreeUnreviewedSigmamediumv1
title: "Windows: PowerShell Module File Creation by Non-PowerShell Process"
id: 9d520799-d627-425d-a4a3-65d891610604
status: test
description: This rule flags the creation of PowerShell module-related files (such as .psm1, .psd1, .dll, and .ps1) under common module directories for Windows PowerShell and PowerShell 7 when the creating process is not one of the expected PowerShell or script host executables. This matters because attackers can persist or execute code by dropping malicious modules into module search paths, and the rule helps surface unexpected file writes. It relies on file create telemetry that includes the target file path and the creating process image.
references:
  - Internal Research
  - https://learn.microsoft.com/en-us/powershell/scripting/developer/module/understanding-a-windows-powershell-module?view=powershell-7.3
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_powershell_module_uncommon_creation.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-09
modified: 2025-10-07
tags:
  - attack.persistence
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - \WindowsPowerShell\Modules\
      - \PowerShell\7\Modules\
  filter_main_pwsh:
    Image|endswith:
      - :\Program Files\PowerShell\7-preview\pwsh.exe
      - :\Program Files\PowerShell\7\pwsh.exe
      - :\Windows\System32\poqexec.exe
      - :\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe
      - :\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      - :\Windows\SysWOW64\poqexec.exe
      - :\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe
      - :\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  filter_main_msiexec:
    Image:
      - C:\Windows\System32\msiexec.exe
      - C:\Windows\SysWOW64\msiexec.exe
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: e3845023-ca9a-4024-b2b2-5422156d5527
    type: derived

What it detects

This rule flags the creation of PowerShell module-related files (such as .psm1, .psd1, .dll, and .ps1) under common module directories for Windows PowerShell and PowerShell 7 when the creating process is not one of the expected PowerShell or script host executables. This matters because attackers can persist or execute code by dropping malicious modules into module search paths, and the rule helps surface unexpected file writes. It relies on file create telemetry that includes the target file path and the creating process image.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.