Sigma medium test sigma

Potential Persistence Via PowerShell User Profile Using Add-Content

Detects calls to "Add-Content" cmdlet in order to modify the content of the user profile and potentially adding suspicious commands for persistence

View Source

Detection Logic

{
  "selection_add": {
    "ScriptBlockText
| contains": "Add-Content $profile"
  },
  "selection_options": {
    "ScriptBlockText
| contains": [
      "-Value \"IEX ",
      "-Value \"Invoke-Expression",
      "-Value \"Invoke-WebRequest",
      "-Value \"Start-Process",
      "-Value 'IEX ",
      "-Value 'Invoke-Expression",
      "-Value 'Invoke-WebRequest",
      "-Value 'Start-Process"
    ]
  },
  "condition": "all of selection_*"
}

False Positives

⚠ Legitimate administration and tuning scripts that aim to add functionality to a user PowerShell session

Field Validations

Loading…

Comments (0)

Loading comments...