Windows PowerShell dropping a .ps1 script from powershell.exe or pwsh.exe
Alerts when PowerShell creates a dropped .ps1 script file on Windows, excluding common benign temp and test outputs.
FreeReviewedSigma · Low · v2
- Product
- windows
- Category
- file_event
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2023-05-09
- Updated
- 2026-07-31
What it detects
This rule identifies instances where PowerShell (powershell.exe or pwsh.exe) creates or writes a script file with a .ps1 extension. Dropping scripts onto disk can indicate staging for later execution or persistence-related workflow, even though the activity can be benign in administrative use. It relies on Windows file event telemetry capturing the executing process path and the target filename, with exclusions for specific temporary and __PSScriptPolicyTest_ paths.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-powershell-pwsh-dropping-ps1-files-via-powershell-exe-576426ad
title: Windows PowerShell dropping a .ps1 script from powershell.exe or pwsh.exe
id: c92ee51b-5861-4ed6-b0a8-9afbdedaa0a9
status: test
description: This rule identifies instances where PowerShell (powershell.exe or pwsh.exe) creates or writes a script file with a .ps1 extension. Dropping scripts onto disk can indicate staging for later execution or persistence-related workflow, even though the activity can be benign in administrative use. It relies on Windows file event telemetry capturing the executing process path and the target filename, with exclusions for specific temporary and __PSScriptPolicyTest_ paths.
references:
- https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_powershell_drop_powershell.yml
author: frack113, Huntrule Team
date: 2023-05-09
tags:
- attack.persistence
logsource:
product: windows
category: file_event
detection:
selection:
Image|endswith:
- \powershell.exe
- \pwsh.exe
TargetFilename|endswith: .ps1
filter_main_psscriptpolicytest:
TargetFilename|contains: __PSScriptPolicyTest_
filter_main_appdata:
TargetFilename|startswith: C:\Users\
TargetFilename|contains: \AppData\Local\Temp\
filter_main_windows_temp:
TargetFilename|startswith: C:\Windows\Temp\
condition: selection and not 1 of filter_main_*
falsepositives:
- False positives will differ depending on the environment and scripts used. Apply additional filters accordingly.
level: low
license: DRL-1.1
related:
- id: 576426ad-0131-4001-ae01-be175da0c108
type: derived