Windows PowerShell Module File Creation via PowerShell Processes
Alert when PowerShell creates module-related files under WindowsPowerShell or PowerShell 7 module directories.
FreeReviewedSigma · Low · v2
- Product
- windows
- Category
- file_event
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-05-09
- Updated
- 2026-07-31
What it detects
This rule flags file creation events where a PowerShell process (powershell.exe or pwsh.exe) writes files under Windows PowerShell module directories. Newly created module artifacts (such as .psm1, .psd1, .ps1, or .dll) can enable persistence or impact execution by introducing code that PowerShell can later load. Detection relies on file event telemetry including the creating process image path and the target filename path under Modules directories.
Reporting behind it
- Internal ResearchInternal Research
- learn.microsoft.comhttps://learn.microsoft.com/en-us/powershell/scripting/developer/module/understanding-a-windows-powershell-module?view=powershell-7.3
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_powershell_module_creation.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-powershell-new-module-file-created-in-modules-directories-e36941d0
title: Windows PowerShell Module File Creation via PowerShell Processes
id: caf26ceb-71d8-46ad-89e2-cd83be284318
status: test
description: This rule flags file creation events where a PowerShell process (powershell.exe or pwsh.exe) writes files under Windows PowerShell module directories. Newly created module artifacts (such as .psm1, .psd1, .ps1, or .dll) can enable persistence or impact execution by introducing code that PowerShell can later load. Detection relies on file event telemetry including the creating process image path and the target filename path under Modules directories.
references:
- Internal Research
- https://learn.microsoft.com/en-us/powershell/scripting/developer/module/understanding-a-windows-powershell-module?view=powershell-7.3
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_powershell_module_creation.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-09
tags:
- attack.persistence
logsource:
category: file_event
product: windows
detection:
selection:
Image|endswith:
- \powershell.exe
- \pwsh.exe
TargetFilename|contains:
- \WindowsPowerShell\Modules\
- \PowerShell\7\Modules\
condition: selection
falsepositives:
- Likely
level: low
license: DRL-1.1
related:
- id: e36941d0-c0f0-443f-bc6f-cb2952eb69ea
type: derived