Windows PowerShell Sensitive File Discovery via Script Block Enumeration

PowerShell script blocks using recursive file enumeration that target sensitive file extensions.

FreeReviewedSigma · Medium · v5

Product: windows
Category: ps_script
Author: frack113 (SigmaHQ), DRL 1.1
Published: 2022-09-16
Updated: 2026-10-21

ATT&CK techniques

Discovery

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
- T1083File and Directory Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies PowerShell script block content that uses common directory/file discovery commands and includes recursion, combined with references to sensitive file extensions. Attackers often enumerate specific files (e.g., password/credential vault formats) to locate data for later access or exfiltration. It relies on Script Block Logging to capture the script text and match command names, the presence of -recurse, and sensitive extensions within the same script block.

Reporting behind it

Related detections9 linkedT1083 — drag to rearrange

Possible Nagios XI Path Traversal via Graphtemplates Directory Parameter

Suspicious Credential String Enumeration via findstr to Temp Directory

Suspicious ipconfig Reconnaissance Output Redirected to CentreStack Log File

Possible osTicket PHP Filter Chain Injection via Anonymous Ticket Endpoints (via webserver)

Possible Local File Inclusion Path Traversal Targeting CentreStack Web.config

PUA: TruffleHog Execution on Windows via trufflehog.exe Process Launch

Linux Process Execution of TruffleHog with Secret-Scanning Platforms

Windows: Notepad Password File Discovery via Process Creation

Linux process execution of shell via nice utility

Windows PowerShell Sensitive File Discovery via Script Block Enumeration

Pivot detection · T1083 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-10-21
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-powershell-sensitive-file-discovery-via-script-block-enumeration-7d416556

title: Windows PowerShell Sensitive File Discovery via Script Block Enumeration
id: d7da2344-795f-43cc-8ab8-1da106cf5e6f
related:
  - id: d23f2ba5-9da0-4463-8908-8ee47f614bb9
    type: derived
  - id: 7d416556-6502-45b2-9bad-9d2f05f38997
    type: derived
status: test
description: This rule identifies PowerShell script block content that uses common directory/file discovery commands and includes recursion, combined with references to sensitive file extensions. Attackers often enumerate specific files (e.g., password/credential vault formats) to locate data for later access or exfiltration. It relies on Script Block Logging to capture the script text and match command names, the presence of -recurse, and sensitive extensions within the same script block.
references:
  - https://twitter.com/malmoeb/status/1570814999370801158
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_sensitive_file_discovery.yml
author: frack113, Huntrule Team
date: 2022-09-16
modified: 2026-10-14
tags:
  - attack.discovery
  - attack.t1083
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection_action:
    ScriptBlockText|re|i: \b(?:get-childitem|gci|ls|dir)\b
  selection_recurse:
    ScriptBlockText|contains: -recurse
  selection_file:
    ScriptBlockText|contains:
      - .pass
      - .kdbx
      - .kdb
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
regression_tests_path: regression_data/rules/windows/powershell/powershell_script/posh_ps_sensitive_file_discovery/info.yml
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL