Windows PowerShell Script File Creation with _64refl.ps1 or host_ip.ps1

title: Windows PowerShell Script File Creation with _64refl.ps1 or host_ip.ps1
id: 8015297b-afca-49cf-84cb-8726d596fcf8
status: test
description: This rule flags creation of PowerShell script files on Windows when the target filename ends with _64refl.ps1 or matches host_ip.ps1. Attackers commonly stage or persist execution by dropping scripts with consistent naming patterns, so file-creation telemetry can reveal early preparation activity. It relies on Windows file event logging that includes the created file path or target filename (TargetFilename).
references:
  - https://labs.withsecure.com/publications/fin7-target-veeam-servers
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/FIN7/file_event_win_apt_fin7_powershell_scripts_naming_convention.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-04
tags:
  - attack.execution
  - attack.g0046
  - detection.emerging-threats
logsource:
  category: file_event
  product: windows
detection:
  selection:
    - TargetFilename|endswith: _64refl.ps1
    - TargetFilename: host_ip.ps1
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: a88d9f45-ec8a-4b0e-85ee-c9f6a65e9128
    type: derived