Windows PowerShell Software Discovery via Get-ItemProperty and Display Formatting

Flags PowerShell registry queries for installed software metadata combined with selection and table formatting.

FreeUnreviewedSigmamediumv1

windows-powershell-software-discovery-via-get-itemproperty-and-display-formattin-2650dd1a

title: Windows PowerShell Software Discovery via Get-ItemProperty and Display Formatting
id: 747dfe5f-87ce-41e5-be5d-cfd8a8d21a9c
status: test
description: This rule identifies PowerShell activity consistent with enumerating installed software by querying registry locations under the Uninstall keys, then selecting common metadata fields and formatting the results. Such discovery helps an attacker understand what software and versions are present, which can guide follow-on targeting and vulnerability assessment. It relies on Script Block Logging telemetry capturing the PowerShell script text executed in the process.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1518/T1518.md
  - https://github.com/harleyQu1nn/AggressorScripts
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_software_discovery.yml
author: Nikita Nazarov, oscd.community, Huntrule Team
date: 2020-10-16
modified: 2022-12-02
tags:
  - attack.discovery
  - attack.t1518
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains|all:
      - get-itemProperty
      - \software\
      - select-object
      - format-table
  condition: selection
falsepositives:
  - Legitimate administration activities
level: medium
license: DRL-1.1
related:
  - id: 2650dd1a-eb2a-412d-ac36-83f06c4f2282
    type: derived

What it detects

This rule identifies PowerShell activity consistent with enumerating installed software by querying registry locations under the Uninstall keys, then selecting common metadata fields and formatting the results. Such discovery helps an attacker understand what software and versions are present, which can guide follow-on targeting and vulnerability assessment. It relies on Script Block Logging telemetry capturing the PowerShell script text executed in the process.

Known false positives

Legitimate administration activities

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.