Sigma medium test sigma

Automated Collection Command PowerShell

Once established within a system or network, an adversary may use automated techniques for collecting internal data.

View Source

Detection Logic

{
  "selection_ext": {
    "ScriptBlockText
| contains": [
      ".doc",
      ".docx",
      ".xls",
      ".xlsx",
      ".ppt",
      ".pptx",
      ".rtf",
      ".pdf",
      ".txt"
    ]
  },
  "selection_cmd": {
    "ScriptBlockText
| contains
| all": [
      "Get-ChildItem",
      " -Recurse ",
      " -Include "
    ]
  },
  "condition": "all of selection*"
}

False Positives

  • ⚠ Unknown

Field Validations

Loading…

Comments (0)

Loading comments...