Query: Sigma rule for Detects PowerShell creating a binary executable or a script file.
Matching passage: Sigma rule: Detects PowerShell creating a binary executable or a script file.. Logsource: windows / file_event. Rule: title: Potential Binary Or Script Dropper Via PowerShell id: 7047d730-036f-4f40-b9d8-1c63e36d5e62 status: test description: Detects PowerShell creating a binary executable or a script file. references: - https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2023-03-17 modified: 2025-07-04 tags: - attack.persistence logsource: product: windows category: file_event detection: selection: Image|endswith: - \powershell.exe - \powershell_ise.exe - \pwsh.exe TargetFilename|endswith: - .bat - .chm - .cmd - .com - .dll - .exe - .hta - .jar - .js - .ocx - .scr - .sys - .vbe - .vbs - .wsf filter_main_user_temp: TargetFilename|startswith: C:\Users\ TargetFilename|contains: \AppData\Local\Temp\ TargetFilename|endswith: - .dll - .exe filter_main_other_temp: TargetFilename|startswith: - C:\Windows\Temp\ - C:\Windows\SystemTemp\ TargetFilename|endswith: - .dll - .exe filter_main_powershell_module: TargetFilename|startswith: C:\Users\ TargetFilename|contains: \WindowsPowerShell\Modules\ TargetFilename|endswith: .dll filter_main_nuget: TargetFilename|startswith: C:\Program Files\PackageManagement\ProviderAssemblies\nuget\ TargetFilename|endswith: \Microsoft.PackageManagement.NuGetProvider.dll condition: selection and not 1 of filter_main_* falsepositives: - False positives will differ depending on the environment and scripts used. Apply additional filters accordingly. level: medium
Near-miss passage: Sigma rule: Detects modification of autostart extensibility point (ASEP) in registry.. Logsource: windows / registry_set. Rule: title: Wow6432Node CurrentVersion Autorun Keys Modification id: b29aed60-ebd1-442b-9cb5-16a1d0324adb related: - id: 17f878b8-9968-4578-b814-c4217fc5768c type: obsolete status: test description: Detects modification of autostart extensibility point (ASEP) in registry. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md - https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns - https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d - https://oddvar.moe/2018/03/21/persistence-using-runonceex-hidden-from-autoruns-exe/ author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split) date: 2019-10-25 modified: 2025-12-08 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.001 logsource: category: registry_set product: windows detection: selection_wow_current_version_base: TargetObject|contains: \SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion selection_wow_current_version_keys: TargetObject|contains: - \ShellServiceObjectDelayLoad - \Run\ - \RunOnce\ - \RunOnceEx\ - \RunServices\ - \RunServicesOnce\ - \Explorer\ShellServiceObjects - \Explorer\ShellIconOverlayIdentifiers - \Explorer\ShellExecuteHooks - \Explorer\SharedTaskScheduler - \Explorer\Browser Helper Objects filter_main_empty: Details: (Empty) filter_main_null: Details: null filter_main_ms_win_desktop_runtime: Details|startswith: '"C:\ProgramData\Package Cache\{d21a4f20-968a-4b0c-bf04-a38da5f06e41}\windowsdesktop-runtime-' filter_main_vcredist: Image|endswith: \VC_redist.x64.exe Details|endswith: '}\VC_redist.x64.exe" /burn.runonce' filter_main_upgrades: Image|startswith: - C:\ProgramData\Package Cache - C:\Windows\Temp\ Image|contains: - \winsdksetup.exe - \windowsdesktop-runtime- - \AspNetCoreSharedFrameworkBundle- Details|endswith: ' /burn.runonce' filter_main_uninstallers: Image|startswith: C:\Windows\Installer\MSI TargetObject|contains: \Explorer\Browser Helper Objects filter_main_msiexec: Image: C:\WINDOWS\system32\msiexec.exe TargetObject|contains: \SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ filter_main_edge: Image|contains|all: - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ - \setup.exe filter_optional_msoffice1: Image: C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe TargetObject|contains: \Office\ClickToRun\REGISTRY\MACHINE\Software\Wow64