huntrule

Windows PowerShell Sensitive File Discovery via Script Block Enumeration

PowerShell script blocks using recursive file enumeration that target sensitive file extensions.

FreeUnreviewedSigmamediumv1
title: Windows PowerShell Sensitive File Discovery via Script Block Enumeration
id: d7da2344-795f-43cc-8ab8-1da106cf5e6f
related:
  - id: d23f2ba5-9da0-4463-8908-8ee47f614bb9
    type: derived
  - id: 7d416556-6502-45b2-9bad-9d2f05f38997
    type: derived
status: test
description: This rule flags PowerShell script block activity that enumerates files using commands such as ls/get-childitem/gci with recursive searching. It also matches access to sensitive file extensions (e.g., .pass, .kdbx, .kdb), which can indicate discovery of credential-related or protected data. The detection relies on Script Block Logging telemetry capturing the executed script text.
references:
  - https://twitter.com/malmoeb/status/1570814999370801158
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_sensitive_file_discovery.yml
author: frack113, Huntrule Team
date: 2022-09-16
tags:
  - attack.discovery
  - attack.t1083
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection_action:
    ScriptBlockText|contains:
      - ls
      - get-childitem
      - gci
  selection_recurse:
    ScriptBlockText|contains: -recurse
  selection_file:
    ScriptBlockText|contains:
      - .pass
      - .kdbx
      - .kdb
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1

What it detects

This rule flags PowerShell script block activity that enumerates files using commands such as ls/get-childitem/gci with recursive searching. It also matches access to sensitive file extensions (e.g., .pass, .kdbx, .kdb), which can indicate discovery of credential-related or protected data. The detection relies on Script Block Logging telemetry capturing the executed script text.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.