Windows PowerShell Sensitive File Discovery via ScriptBlock Enumeration
PowerShell script blocks using recursive file enumeration that target sensitive file extensions.
- Product
- windows
- Category
- ps_script
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-09-16
- Updated
- 2026-07-31
ATT&CK techniques
DiscoveryRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies PowerShell script block activity that enumerates files using common directory listing commands and optionally includes recursive search. It further looks for targeting of sensitive file extensions such as .pass, .kdbx, and .kdb, which can indicate attacker discovery of credential or password vault data. The detection relies on ScriptBlockText contents from PowerShell script block logging on Windows.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows PowerShell Sensitive File Discovery via ScriptBlock Enumeration
id: d7da2344-795f-43cc-8ab8-1da106cf5e6f
related:
- id: d23f2ba5-9da0-4463-8908-8ee47f614bb9
type: derived
- id: 7d416556-6502-45b2-9bad-9d2f05f38997
type: derived
status: test
description: This rule identifies PowerShell script block activity that enumerates files using common directory listing commands and optionally includes recursive search. It further looks for targeting of sensitive file extensions such as .pass, .kdbx, and .kdb, which can indicate attacker discovery of credential or password vault data. The detection relies on ScriptBlockText contents from PowerShell script block logging on Windows.
references:
- https://twitter.com/malmoeb/status/1570814999370801158
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_sensitive_file_discovery.yml
author: frack113, Huntrule Team
date: 2022-09-16
tags:
- attack.discovery
- attack.t1083
logsource:
product: windows
category: ps_script
definition: "Requirements: Script Block Logging must be enabled"
detection:
selection_action:
ScriptBlockText|contains:
- ls
- get-childitem
- gci
selection_recurse:
ScriptBlockText|contains: -recurse
selection_file:
ScriptBlockText|contains:
- .pass
- .kdbx
- .kdb
condition: all of selection_*
falsepositives:
- Unknown
level: medium
license: DRL-1.1