Windows PowerShell: New Module File Created in Modules Directories

Alert when PowerShell creates module-related files under WindowsPowerShell or PowerShell 7 module directories.

FreeUnreviewedSigmalowv1

windows-powershell-new-module-file-created-in-modules-directories-e36941d0

title: "Windows PowerShell: New Module File Created in Modules Directories"
id: caf26ceb-71d8-46ad-89e2-cd83be284318
status: test
description: This rule flags file creation events where the creating process is Windows PowerShell (powershell.exe or pwsh.exe) and the target path is under common PowerShell module directories. Attackers may use this to persist or stage malicious functionality by writing new module files such as .psm1, .psd1, .ps1, or .dll. It relies on file event telemetry that includes the process image path and the target filename/path for newly created files.
references:
  - Internal Research
  - https://learn.microsoft.com/en-us/powershell/scripting/developer/module/understanding-a-windows-powershell-module?view=powershell-7.3
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_powershell_module_creation.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-09
tags:
  - attack.persistence
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith:
      - \powershell.exe
      - \pwsh.exe
    TargetFilename|contains:
      - \WindowsPowerShell\Modules\
      - \PowerShell\7\Modules\
  condition: selection
falsepositives:
  - Likely
level: low
license: DRL-1.1
related:
  - id: e36941d0-c0f0-443f-bc6f-cb2952eb69ea
    type: derived

What it detects

This rule flags file creation events where the creating process is Windows PowerShell (powershell.exe or pwsh.exe) and the target path is under common PowerShell module directories. Attackers may use this to persist or stage malicious functionality by writing new module files such as .psm1, .psd1, .ps1, or .dll. It relies on file event telemetry that includes the process image path and the target filename/path for newly created files.

Known false positives

Likely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.