Query: Sigma rule for Detects PowerShell scripts to set the ACL to a file in the Windows folder
Matching passage: Sigma rule: Detects PowerShell scripts to set the ACL to a file in the Windows folder. Logsource: windows / ps_script. Rule: title: PowerShell Set-Acl On Windows Folder - PsScript id: 3bf1d859-3a7e-44cb-8809-a99e066d3478 related: - id: cae80281-ef23-44c5-873b-fd48d2666f49 type: derived - id: 0944e002-e3f6-4eb5-bf69-3a3067b53d73 type: derived - id: bdeb2cff-af74-4094-8426-724dc937f20a type: derived status: test description: Detects PowerShell scripts to set the ACL to a file in the Windows folder references: - https://github.com/redcanaryco/atomic-red-team/blob/74438b0237d141ee9c99747976447dc884cb1a39/atomics/T1505.005/T1505.005.md - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/set-acl?view=powershell-5.1 author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2023-07-18 tags: - attack.defense-impairment - attack.t1222 logsource: product: windows category: ps_script definition: bade5735-5ab0-4aa7-a642-a11be0e40872 detection: selection_cmdlet: ScriptBlockText|contains|all: - 'Set-Acl ' - '-AclObject ' selection_paths: ScriptBlockText|contains: - -Path "C:\Windows - -Path "C:/Windows - -Path 'C:\Windows - -Path 'C:/Windows - -Path C:\\Windows - -Path C:/Windows - -Path $env:windir - -Path "$env:windir - -Path '$env:windir selection_permissions: ScriptBlockText|contains: - FullControl - Allow condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects tampering of AMSI (Anti-Malware Scan Interface) related registry values via command line tools such as reg.exe o. Logsource: windows / process_creation. Rule: title: Windows AMSI Related Registry Tampering Via CommandLine id: 7dbbcac2-57a0-45ac-b306-ff30a8bd2981 related: - id: aa37cbb0-da36-42cb-a90f-fdf216fc7467 type: similar status: experimental description: 'Detects tampering of AMSI (Anti-Malware Scan Interface) related registry values via command line tools such as reg.exe or PowerShell. AMSI provides a generic interface for applications and services to integrate with antimalware products. Adversaries may disable AMSI to evade detection of malicious scripts and code execution. ' references: - https://github.com/arttoolkit/arttoolkit.github.io/blob/16d6230d009e58fd6f773f5317fd4d14c1f26004/_wadcoms/AMSI-Bypass-Jscript_amsienable.md - https://mostafayahiax.medium.com/hunting-for-amsi-bypassing-methods-9886dda0bf9d - https://www.mdsec.co.uk/2019/02/macros-and-more-with-sharpshooter-v2-0/ author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-12-25 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection_key: CommandLine|contains|all: - \Software\Microsoft\Windows Script\Settings - AmsiEnable selection_reg_img: - Image|endswith: \reg.exe - OriginalFileName: reg.exe selection_reg_cmd: CommandLine|contains: add selection_powershell_img: - Image|endswith: - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll selection_powershell_cmd: CommandLine|contains: - Set-ItemProperty - New-ItemProperty - 'sp ' condition: selection_key and (all of selection_powershell_* or all of selection_reg_*) falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_amsi_registry_tampering/info.yml simulation: - type: atomic-red-team name: AMSI Bypass - Create AMSIEnable Reg Key technique: T1562.001 atomic_guid: 728eca7b-0444-4f6f-ac36-437e3d751dc0