Detectionmediumtest

Automated Collection Command PowerShell

Once established within a system or network, an adversary may use automated techniques for collecting internal data.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

François HubautCreated Wed Jul 28Updated Sun Dec 25c1dda054-d638-4c16-afc8-53e007f3fbc5windows

Log Source

WindowsPowerShell Script

ProductWindows← raw: windows

CategoryPowerShell Script← raw: ps_script

Definition

Requirements: Script Block Logging must be enabled

Detection Logic

detection:
    selection_ext:
        ScriptBlockText|contains:
            - '.doc'
            - '.docx'
            - '.xls'
            - '.xlsx'
            - '.ppt'
            - '.pptx'
            - '.rtf'
            - '.pdf'
            - '.txt'
    selection_cmd:
        ScriptBlockText|contains|all:
            - 'Get-ChildItem'
            - ' -Recurse '
            - ' -Include '
    condition: all of selection*