Windows: PowerShell/ pwsh Dropping .ps1 Files via PowerShell.EXE

Alerts when PowerShell creates a dropped .ps1 script file on Windows, excluding common benign temp and test outputs.

FreeUnreviewedSigmalowv1

windows-powershell-pwsh-dropping-ps1-files-via-powershell-exe-576426ad

title: "Windows: PowerShell/ pwsh Dropping .ps1 Files via PowerShell.EXE"
id: c92ee51b-5861-4ed6-b0a8-9afbdedaa0a9
status: test
description: This rule flags Windows file creation events where PowerShell (powershell.exe or pwsh.exe) writes a target file ending in .ps1. Adversaries may use this behavior to drop script files for later execution as part of persistence or other stages of an attack. The detection relies on file event telemetry capturing the creating process image path and the created file name, with exclusions for common temporary and __PSScriptPolicyTest_ script patterns.
references:
  - https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_powershell_drop_powershell.yml
author: frack113, Huntrule Team
date: 2023-05-09
tags:
  - attack.persistence
logsource:
  product: windows
  category: file_event
detection:
  selection:
    Image|endswith:
      - \powershell.exe
      - \pwsh.exe
    TargetFilename|endswith: .ps1
  filter_main_psscriptpolicytest:
    TargetFilename|contains: __PSScriptPolicyTest_
  filter_main_appdata:
    TargetFilename|startswith: C:\Users\
    TargetFilename|contains: \AppData\Local\Temp\
  filter_main_windows_temp:
    TargetFilename|startswith: C:\Windows\Temp\
  condition: selection and not 1 of filter_main_*
falsepositives:
  - False positives will differ depending on the environment and scripts used. Apply additional filters accordingly.
level: low
license: DRL-1.1
related:
  - id: 576426ad-0131-4001-ae01-be175da0c108
    type: derived

What it detects

This rule flags Windows file creation events where PowerShell (powershell.exe or pwsh.exe) writes a target file ending in .ps1. Adversaries may use this behavior to drop script files for later execution as part of persistence or other stages of an attack. The detection relies on file event telemetry capturing the creating process image path and the created file name, with exclusions for common temporary and __PSScriptPolicyTest_ script patterns.

Known false positives

False positives will differ depending on the environment and scripts used. Apply additional filters accordingly.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.