detection.wiki

Detection rules › Sigma

PowerShell Script Dropped Via PowerShell.EXE

Status
test
Severity
low
Log source
product windows, category file_event
Author
frack113
Source
github.com/SigmaHQ/sigma

Detects PowerShell creating a PowerShell file (.ps1). While often times this behavior is benign, sometimes it can be a sign of a dropper script trying to achieve persistence.

MITRE ATT&CK coverage

TacticTechniques
PersistenceNo specific technique

Event coverage

ProviderEventTitle
SysmonEvent ID 11FileCreate

Rule body yaml

title: PowerShell Script Dropped Via PowerShell.EXE
id: 576426ad-0131-4001-ae01-be175da0c108
status: test
description: Detects PowerShell creating a PowerShell file (.ps1). While often times this behavior is benign, sometimes it can be a sign of a dropper script trying to achieve persistence.
references:
    - https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
author: frack113
date: 2023-05-09
tags:
    - attack.persistence
logsource:
    product: windows
    category: file_event
detection:
    selection:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
        TargetFilename|endswith: '.ps1'
    filter_main_psscriptpolicytest:
        TargetFilename|contains: '__PSScriptPolicyTest_'
    filter_main_appdata:
        TargetFilename|startswith: 'C:\Users\'
        TargetFilename|contains: '\AppData\Local\Temp\'
    filter_main_windows_temp:
        TargetFilename|startswith: 'C:\Windows\Temp\'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - False positives will differ depending on the environment and scripts used. Apply additional filters accordingly.
level: low

Stages and Predicates

Stage 0: condition

selection and not 1 of filter_main_*

Stage 1: selection

selection:
    Image|endswith:
        - '\powershell.exe'
        - '\pwsh.exe'
    TargetFilename|endswith: '.ps1'

Stage 2: not filter_main_*

filter_main_psscriptpolicytest:
    TargetFilename|contains: '__PSScriptPolicyTest_'
filter_main_appdata:
    TargetFilename|startswith: 'C:\Users\'
    TargetFilename|contains: '\AppData\Local\Temp\'
filter_main_windows_temp:
    TargetFilename|startswith: 'C:\Windows\Temp\'

Exclusions

Top-level NOT(...) conjuncts: predicates this rule actively suppresses.

FieldKindExcluded values
TargetFilenamematch\AppData\Local\Temp\
TargetFilenamestarts_withC:\Users\
TargetFilenamematch__PSScriptPolicyTest_
TargetFilenamestarts_withC:\Windows\Temp\

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Imageends_with
  • \powershell.exe corpus 182 (sigma 182)
  • \pwsh.exe corpus 168 (sigma 168)
TargetFilenameends_with
  • .ps1 corpus 17 (sigma 17)