Query: write Sigma for Detects the creation of the "PSScriptPolicyTest" PowerShell script by an uncommon process. This file is usually generate
Matching passage: Sigma rule: Detects the creation of the "PSScriptPolicyTest" PowerShell script by an uncommon process. This file is usually generate. Logsource: windows / file_event. Rule: title: PSScriptPolicyTest Creation By Uncommon Process id: 1027d292-dd87-4a1a-8701-2abe04d7783c status: test description: Detects the creation of the "PSScriptPolicyTest" PowerShell script by an uncommon process. This file is usually generated by Microsoft Powershell to test against Applocker. references: - https://www.paloaltonetworks.com/blog/security-operations/stopping-powershell-without-powershell/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-06-01 modified: 2026-07-28 tags: - attack.stealth logsource: product: windows category: file_event detection: selection: TargetFilename|contains: __PSScriptPolicyTest_ filter_main_powershell: Image: - C:\Program Files\PowerShell\7-preview\pwsh.exe - C:\Program Files\PowerShell\7\pwsh.exe - C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe filter_main_pwsh_preview: Image|contains: - C:\Program Files\WindowsApps\Microsoft.PowerShellPreview - \AppData\Local\Microsoft\WindowsApps\Microsoft.PowerShellPreview Image|endswith: \pwsh.exe filter_main_generic: Image: - C:\Windows\System32\dsac.exe - C:\Windows\System32\sdiagnhost.exe - C:\Windows\System32\ServerManager.exe - C:\Windows\System32\wsmprovhost.exe - C:\Windows\SysWOW64\sdiagnhost.exe filter_optional_gethelp: Image|startswith: C:\Program Files\WindowsApps\Microsoft.GetHelp_ Image|endswith: \GetHelp.exe condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects PowerShell module creation where the module Contents are set to "function Get-VMRemoteFXPhysicalVideoAdapter". T. Logsource: windows / ps_module. Rule: title: Potential RemoteFXvGPUDisablement.EXE Abuse - PowerShell Module id: 38a7625e-b2cb-485d-b83d-aff137d859f4 related: - id: a6fc3c46-23b8-4996-9ea2-573f4c4d88c5 type: similar - id: f65e22f9-819e-4f96-9c7b-498364ae7a25 type: similar - id: cacef8fc-9d3d-41f7-956d-455c6e881bc5 type: similar status: test description: Detects PowerShell module creation where the module Contents are set to "function Get-VMRemoteFXPhysicalVideoAdapter". This could be a sign of potential abuse of the "RemoteFXvGPUDisablement.exe" binary which is known to be vulnerable to module load-order hijacking. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md - https://github.com/redcanaryco/AtomicTestHarnesses/blob/7e1e4da116801e3d6fcc6bedb207064577e40572/TestHarnesses/T1218_SignedBinaryProxyExecution/InvokeRemoteFXvGPUDisablementCommand.ps1 author: Nasreddine Bencherchali (Nextron Systems), frack113 date: 2021-07-13 modified: 2023-05-09 tags: - attack.stealth - attack.t1218 logsource: product: windows category: ps_module definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b detection: selection: Payload|contains: ModuleContents=function Get-VMRemoteFXPhysicalVideoAdapter { condition: selection falsepositives: - Unknown level: high