huntrule

Windows PowerShell: Import-Module From Temp, AppData, or Public Directories

Detects PowerShell module imports (Import-Module/ipmo) from Temp, AppData, or Public directories via Script Block Logging.

FreeReviewedSigma · Medium · v2
Product
windows
Category
ps_script
Author
Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2022-07-07
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Execution

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags PowerShell script text that imports modules from commonly abused locations, specifically paths under %Temp%, %AppData%, and C:\Users\Public\. Attackers often use Import-Module to load malicious code without dropping a standalone payload, making module import behavior a useful execution signal. It relies on PowerShell script block logging telemetry that records the script content, matching specific Import-Module and ipmo command patterns referencing those directories.

Reporting behind it

Related detections9 linkedT1059.001 — drag to rearrange
Suspicious PsExec Service Launching Encoded PowerShell Payload
Suspicious PowerShell Remote Script Execution via IEX DownloadString
Malicious SharePoint ToolShell Post-Exploitation via Encoded PowerShell (via process_creation)
Suspicious In-Memory PowerShell Execution from Web Server via Automation Assembly (via image_load)
Malicious Qilin Chrome Credential Harvesting Script Execution via IPScanner (via process_creation)
Suspicious Hidden PowerShell Spawned by Script Host via process_creation
Suspicious Run Key Persistence Referencing PowerShell Script via registry_set
Malicious FIN7 Powertrash Loader Execution via Obfuscated PowerShell (via process_creation)
Suspicious XOR Obfuscated PowerShell from ClickFix Distribution
Windows PowerShell: Import-Module From Temp, AppData, or Public Directories
Pivot detection · T1059.001 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.