Query: detection rule: Detects the creation of the "PSScriptPolicyTest" PowerShell script by an uncommon process. This file is usually generate
Matching passage: Sigma rule: Detects the creation of the "PSScriptPolicyTest" PowerShell script by an uncommon process. This file is usually generate. Logsource: windows / file_event. Rule: title: PSScriptPolicyTest Creation By Uncommon Process id: 1027d292-dd87-4a1a-8701-2abe04d7783c status: test description: Detects the creation of the "PSScriptPolicyTest" PowerShell script by an uncommon process. This file is usually generated by Microsoft Powershell to test against Applocker. references: - https://www.paloaltonetworks.com/blog/security-operations/stopping-powershell-without-powershell/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-06-01 modified: 2026-07-28 tags: - attack.stealth logsource: product: windows category: file_event detection: selection: TargetFilename|contains: __PSScriptPolicyTest_ filter_main_powershell: Image: - C:\Program Files\PowerShell\7-preview\pwsh.exe - C:\Program Files\PowerShell\7\pwsh.exe - C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe filter_main_pwsh_preview: Image|contains: - C:\Program Files\WindowsApps\Microsoft.PowerShellPreview - \AppData\Local\Microsoft\WindowsApps\Microsoft.PowerShellPreview Image|endswith: \pwsh.exe filter_main_generic: Image: - C:\Windows\System32\dsac.exe - C:\Windows\System32\sdiagnhost.exe - C:\Windows\System32\ServerManager.exe - C:\Windows\System32\wsmprovhost.exe - C:\Windows\SysWOW64\sdiagnhost.exe filter_optional_gethelp: Image|startswith: C:\Program Files\WindowsApps\Microsoft.GetHelp_ Image|endswith: \GetHelp.exe condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects listing of the inodes of the "/" directory to determine if the we are running inside of a container.. Logsource: linux / process_creation. Rule: title: Potential Container Discovery Via Inodes Listing id: 43e26eb5-cd58-48d1-8ce9-a273f5d298d8 status: test description: Detects listing of the inodes of the "/" directory to determine if the we are running inside of a container. references: - https://blog.skyplabs.net/posts/container-detection/ - https://stackoverflow.com/questions/20010199/how-to-determine-if-a-process-runs-inside-lxc-docker tags: - attack.discovery - attack.t1082 author: Seth Hanford date: 2023-08-23 modified: 2025-11-24 logsource: category: process_creation product: linux detection: selection_ls_img: Image|endswith: /ls selection_ls_cli: - CommandLine|endswith: ' /' - CommandLine|contains: ' / ' selection_regex_inode: CommandLine|re: (?:\s-[^-\s]{0,20}i|\s--inode\s) selection_regex_dir: CommandLine|re: (?:\s-[^-\s]{0,20}d|\s--directory\s) condition: all of selection_* falsepositives: - Legitimate system administrator usage of these commands - Some container tools or deployments may use these techniques natively to determine how they proceed with execution, and will need to be filtered level: low