Windows PowerShell Software Enumeration via Script Block Content
Flags PowerShell registry queries for installed software metadata combined with selection and table formatting.
- Product
- windows
- Category
- ps_script
- Author
- Nikita Nazarov, oscd.community (SigmaHQ), DRL 1.1
- Published
- 2020-10-16
- Updated
- 2026-07-31
ATT&CK techniques
DiscoveryRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies PowerShell script block activity that performs local software discovery by combining registry queries under a Windows software path with output formatting. Such enumeration can help an attacker determine installed products and versions to assess exposure and tailor follow-on activity. Telemetry relies on Script Block logging capturing the script text content for matching registry-related queries and PowerShell cmdlets.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1518/T1518.md
- github.comhttps://github.com/harleyQu1nn/AggressorScripts
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_software_discovery.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows PowerShell Software Enumeration via Script Block Content
id: 747dfe5f-87ce-41e5-be5d-cfd8a8d21a9c
status: test
description: This rule identifies PowerShell script block activity that performs local software discovery by combining registry queries under a Windows software path with output formatting. Such enumeration can help an attacker determine installed products and versions to assess exposure and tailor follow-on activity. Telemetry relies on Script Block logging capturing the script text content for matching registry-related queries and PowerShell cmdlets.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1518/T1518.md
- https://github.com/harleyQu1nn/AggressorScripts
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_software_discovery.yml
author: Nikita Nazarov, oscd.community, Huntrule Team
date: 2020-10-16
modified: 2022-12-02
tags:
- attack.discovery
- attack.t1518
logsource:
product: windows
category: ps_script
definition: "Requirements: Script Block Logging must be enabled"
detection:
selection:
ScriptBlockText|contains|all:
- get-itemProperty
- \software\
- select-object
- format-table
condition: selection
falsepositives:
- Legitimate administration activities
level: medium
license: DRL-1.1
related:
- id: 2650dd1a-eb2a-412d-ac36-83f06c4f2282
type: derived