Windows PowerShell Persistence: Add-Content to Modify $profile for Startup Execution

Detects PowerShell Add-Content writing to $profile, especially when paired with common command-loading or execution payloads.

FreeUnreviewedSigmamediumv1

windows-powershell-persistence-add-content-to-modify-profile-for-startup-executi-05b3e303

title: "Windows PowerShell Persistence: Add-Content to Modify $profile for Startup Execution"
id: a79a1cde-b61a-411b-815b-d92ad47f8dbc
status: test
description: This rule flags PowerShell script block text that uses the Add-Content cmdlet to write content into the current user's PowerShell profile ($profile). An attacker can abuse profile modification to introduce commands that execute when PowerShell starts, enabling persistence or repeated execution of malicious logic. It relies on Script Block Logging telemetry that captures the exact ScriptBlockText content matching Add-Content $profile and additional suspicious -Value patterns such as IEX, Invoke-Expression, Invoke-WebRequest, or Start-Process.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.013/T1546.013.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_user_profile_tampering.yml
author: frack113, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2021-08-18
modified: 2023-05-04
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1546.013
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection_add:
    ScriptBlockText|contains: Add-Content $profile
  selection_options:
    ScriptBlockText|contains:
      - '-Value "IEX '
      - -Value "Invoke-Expression
      - -Value "Invoke-WebRequest
      - -Value "Start-Process
      - "-Value 'IEX "
      - -Value 'Invoke-Expression
      - -Value 'Invoke-WebRequest
      - -Value 'Start-Process
  condition: all of selection_*
falsepositives:
  - Legitimate administration and tuning scripts that aim to add functionality to a user PowerShell session
level: medium
license: DRL-1.1
related:
  - id: 05b3e303-faf0-4f4a-9b30-46cc13e69152
    type: derived

What it detects

This rule flags PowerShell script block text that uses the Add-Content cmdlet to write content into the current user's PowerShell profile ($profile). An attacker can abuse profile modification to introduce commands that execute when PowerShell starts, enabling persistence or repeated execution of malicious logic. It relies on Script Block Logging telemetry that captures the exact ScriptBlockText content matching Add-Content $profile and additional suspicious -Value patterns such as IEX, Invoke-Expression, Invoke-WebRequest, or Start-Process.

Known false positives

Legitimate administration and tuning scripts that aim to add functionality to a user PowerShell session

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.