Windows PowerShell Sensitive File Discovery via Script Block Enumeration
PowerShell script blocks using recursive file enumeration that target sensitive file extensions.
- Product
- windows
- Category
- ps_script
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-09-16
- Updated
- 2026-10-21
ATT&CK techniques
DiscoveryRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies PowerShell script block content that uses common directory/file discovery commands and includes recursion, combined with references to sensitive file extensions. Attackers often enumerate specific files (e.g., password/credential vault formats) to locate data for later access or exfiltration. It relies on Script Block Logging to capture the script text and match command names, the presence of -recurse, and sensitive extensions within the same script block.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-10-21
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows PowerShell Sensitive File Discovery via Script Block Enumeration
id: d7da2344-795f-43cc-8ab8-1da106cf5e6f
related:
- id: d23f2ba5-9da0-4463-8908-8ee47f614bb9
type: derived
- id: 7d416556-6502-45b2-9bad-9d2f05f38997
type: derived
status: test
description: This rule identifies PowerShell script block content that uses common directory/file discovery commands and includes recursion, combined with references to sensitive file extensions. Attackers often enumerate specific files (e.g., password/credential vault formats) to locate data for later access or exfiltration. It relies on Script Block Logging to capture the script text and match command names, the presence of -recurse, and sensitive extensions within the same script block.
references:
- https://twitter.com/malmoeb/status/1570814999370801158
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_sensitive_file_discovery.yml
author: frack113, Huntrule Team
date: 2022-09-16
modified: 2026-10-14
tags:
- attack.discovery
- attack.t1083
logsource:
product: windows
category: ps_script
definition: "Requirements: Script Block Logging must be enabled"
detection:
selection_action:
ScriptBlockText|re|i: \b(?:get-childitem|gci|ls|dir)\b
selection_recurse:
ScriptBlockText|contains: -recurse
selection_file:
ScriptBlockText|contains:
- .pass
- .kdbx
- .kdb
condition: all of selection_*
falsepositives:
- Unknown
level: medium
regression_tests_path: regression_data/rules/windows/powershell/powershell_script/posh_ps_sensitive_file_discovery/info.yml
license: DRL-1.1