Windows: New PowerShell Module Files Created by Non-PowerShell Processes
Detects new PowerShell module files written into Modules directories by processes other than expected PowerShell hosts.
FreeReviewedSigma · Medium · v2
- Product
- windows
- Category
- file_event
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-05-09
- Updated
- 2026-07-31
What it detects
This rule identifies the creation of PowerShell module-related files (such as .psm1, .psd1, .ps1, .dll) under WindowsPowerShell\Modules or PowerShell 7\Modules by processes other than common PowerShell or installer binaries. Attackers may abuse module loading to persist code that can later be executed within PowerShell contexts. It relies on Windows file creation event telemetry, specifically the target file path and the creating process image.
Reporting behind it
- Internal ResearchInternal Research
- learn.microsoft.comhttps://learn.microsoft.com/en-us/powershell/scripting/developer/module/understanding-a-windows-powershell-module?view=powershell-7.3
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_powershell_module_uncommon_creation.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-powershell-module-file-creation-by-non-powershell-process-e3845023
title: "Windows: New PowerShell Module Files Created by Non-PowerShell Processes"
id: 9d520799-d627-425d-a4a3-65d891610604
status: test
description: This rule identifies the creation of PowerShell module-related files (such as .psm1, .psd1, .ps1, .dll) under WindowsPowerShell\Modules or PowerShell 7\Modules by processes other than common PowerShell or installer binaries. Attackers may abuse module loading to persist code that can later be executed within PowerShell contexts. It relies on Windows file creation event telemetry, specifically the target file path and the creating process image.
references:
- Internal Research
- https://learn.microsoft.com/en-us/powershell/scripting/developer/module/understanding-a-windows-powershell-module?view=powershell-7.3
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_powershell_module_uncommon_creation.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-09
modified: 2025-10-07
tags:
- attack.persistence
logsource:
category: file_event
product: windows
detection:
selection:
TargetFilename|contains:
- \WindowsPowerShell\Modules\
- \PowerShell\7\Modules\
filter_main_pwsh:
Image|endswith:
- :\Program Files\PowerShell\7-preview\pwsh.exe
- :\Program Files\PowerShell\7\pwsh.exe
- :\Windows\System32\poqexec.exe
- :\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe
- :\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
- :\Windows\SysWOW64\poqexec.exe
- :\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe
- :\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
filter_main_msiexec:
Image:
- C:\Windows\System32\msiexec.exe
- C:\Windows\SysWOW64\msiexec.exe
condition: selection and not 1 of filter_main_*
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: e3845023-ca9a-4024-b2b2-5422156d5527
type: derived