Windows PowerShell dropping a .ps1 script from powershell.exe or pwsh.exe

title: Windows PowerShell dropping a .ps1 script from powershell.exe or pwsh.exe
id: c92ee51b-5861-4ed6-b0a8-9afbdedaa0a9
status: test
description: This rule identifies instances where PowerShell (powershell.exe or pwsh.exe) creates or writes a script file with a .ps1 extension. Dropping scripts onto disk can indicate staging for later execution or persistence-related workflow, even though the activity can be benign in administrative use. It relies on Windows file event telemetry capturing the executing process path and the target filename, with exclusions for specific temporary and __PSScriptPolicyTest_ paths.
references:
  - https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_powershell_drop_powershell.yml
author: frack113, Huntrule Team
date: 2023-05-09
tags:
  - attack.persistence
logsource:
  product: windows
  category: file_event
detection:
  selection:
    Image|endswith:
      - \powershell.exe
      - \pwsh.exe
    TargetFilename|endswith: .ps1
  filter_main_psscriptpolicytest:
    TargetFilename|contains: __PSScriptPolicyTest_
  filter_main_appdata:
    TargetFilename|startswith: C:\Users\
    TargetFilename|contains: \AppData\Local\Temp\
  filter_main_windows_temp:
    TargetFilename|startswith: C:\Windows\Temp\
  condition: selection and not 1 of filter_main_*
falsepositives:
  - False positives will differ depending on the environment and scripts used. Apply additional filters accordingly.
level: low
license: DRL-1.1
related:
  - id: 576426ad-0131-4001-ae01-be175da0c108
    type: derived