Windows PowerShell: Add-Content to $profile for Potential Persistence
Detects PowerShell Add-Content writing to $profile, especially when paired with common command-loading or execution payloads.
- Product
- windows
- Category
- ps_script
- Author
- frack113, Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2021-08-18
- Updated
- 2026-07-31
ATT&CK techniques
Persistence → Priv EscRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags PowerShell script block activity containing 'Add-Content $profile', indicating an attempt to write content into the current user’s PowerShell profile. It matters because modifying $profile can introduce attacker-controlled commands that execute automatically in future PowerShell sessions. The detection relies on ScriptBlockText telemetry (with Script Block Logging enabled) and matches when the script writes profile content and includes suspicious command strings such as Invoke-Expression, IEX, Invoke-WebRequest, or Start-Process.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows PowerShell: Add-Content to $profile for Potential Persistence"
id: a79a1cde-b61a-411b-815b-d92ad47f8dbc
status: test
description: This rule flags PowerShell script block activity containing 'Add-Content $profile', indicating an attempt to write content into the current user’s PowerShell profile. It matters because modifying $profile can introduce attacker-controlled commands that execute automatically in future PowerShell sessions. The detection relies on ScriptBlockText telemetry (with Script Block Logging enabled) and matches when the script writes profile content and includes suspicious command strings such as Invoke-Expression, IEX, Invoke-WebRequest, or Start-Process.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.013/T1546.013.md
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_user_profile_tampering.yml
author: frack113, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2021-08-18
modified: 2023-05-04
tags:
- attack.persistence
- attack.privilege-escalation
- attack.t1546.013
logsource:
product: windows
category: ps_script
definition: "Requirements: Script Block Logging must be enabled"
detection:
selection_add:
ScriptBlockText|contains: Add-Content $profile
selection_options:
ScriptBlockText|contains:
- '-Value "IEX '
- -Value "Invoke-Expression
- -Value "Invoke-WebRequest
- -Value "Start-Process
- "-Value 'IEX "
- -Value 'Invoke-Expression
- -Value 'Invoke-WebRequest
- -Value 'Start-Process
condition: all of selection_*
falsepositives:
- Legitimate administration and tuning scripts that aim to add functionality to a user PowerShell session
level: medium
license: DRL-1.1
related:
- id: 05b3e303-faf0-4f4a-9b30-46cc13e69152
type: derived