Extracting Information with PowerShell

Status: test
Severity: medium
Log source: category ps_script, product windows
Author: frack113
Source: github.com/SigmaHQ/sigma

Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1552.001` Unsecured Credentials: Credentials In Files

Telemetry coverage

Provider	Record / event type
PowerShell	Event ID 4104: Creating Scriptblock text (MessageNumber of MessageTotal).

Rule body

title: Extracting Information with PowerShell
id: bd5971a7-626d-46ab-8176-ed643f694f68
status: test
description: |
    Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials.
    These can be files created by users to store their own credentials, shared credential stores for a group of individuals,
    configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.001/T1552.001.md
author: frack113
date: 2021-12-19
modified: 2022-12-25
tags:
    - attack.credential-access
    - attack.t1552.001
logsource:
    product: windows
    category: ps_script
    definition: 'Requirements: Script Block Logging must be enabled'
detection:
    selection:
        ScriptBlockText|contains|all:
            - ls
            - ' -R'
            - 'select-string '
            - '-Pattern '
    condition: selection
falsepositives:
    - Unknown
level: medium

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    ScriptBlockText|contains|all:
        - ls
        - ' -R'
        - 'select-string '
        - '-Pattern '

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ScriptBlockText`	match	`-R` `-Pattern` `ls` corpus 2 (sigma 2) `select-string`	`field:"ScriptBlockText" kind:match`