Potential Persistence Via PowerShell User Profile Using Add-Content

{
  "ps_script": {
    "EventID": 4104,
    "Channel": [
      "Microsoft-Windows-PowerShell/Operational",
      "PowerShellCore/Operational"
    ]
  },
  "selection_add": {
    "ScriptBlockText
| contains": "Add-Content $profile"
  },
  "selection_options": {
    "ScriptBlockText
| contains": [
      "-Value \"IEX ",
      "-Value \"Invoke-Expression",
      "-Value \"Invoke-WebRequest",
      "-Value \"Start-Process",
      "-Value 'IEX ",
      "-Value 'Invoke-Expression",
      "-Value 'Invoke-WebRequest",
      "-Value 'Start-Process"
    ]
  },
  "condition": "ps_script and (all of selection_*)"
}

False Positives

• ⚠ Legitimate administration and tuning scripts that aim to add functionality to a user PowerShell session