Detectionmediumtest

Powershell Directory Enumeration

Detects technique used by MAZE ransomware to enumerate directories using Powershell

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
François HubautCreated Thu Mar 17162e69a7-7981-4344-84a9-0f1c9a217a52windows
Log Source
WindowsPowerShell Script
ProductWindows← raw: windows
CategoryPowerShell Script← raw: ps_script

Definition

Requirements: Script Block Logging must be enabled

Detection Logic
Detection Logic1 selector
detection:
    selection:
        ScriptBlockText|contains|all:
            - foreach
            - Get-ChildItem
            - '-Path '
            - '-ErrorAction '
            - SilentlyContinue
            - 'Out-File '
            - '-append'
    condition: selection
False Positives

Legitimate PowerShell scripts

Rule Metadata
Rule ID
162e69a7-7981-4344-84a9-0f1c9a217a52
Status
test
Level
medium
Type
Detection
Created
Thu Mar 17
Path
rules/windows/powershell/powershell_script/posh_ps_susp_directory_enum.yml
Raw Tags
attack.discoveryattack.t1083
View on GitHub