Detection rules › Sigma
PowerShell Module File Created By Non-PowerShell Process
Detects the creation of a new PowerShell module ".psm1", ".psd1", ".dll", ".ps1", etc. by a non-PowerShell process
Event coverage
| Provider | Event ID | Title |
|---|---|---|
| Sysmon | 11 | FileCreate |
Stages and Predicates
Stage 1: selection
or:
TargetFilename|contains: '\PowerShell\7\Modules\'
TargetFilename|contains: '\WindowsPowerShell\Modules\'
Stage 2: not 1 of filter_main_*
or:
Image|endswith: ':\Program Files\PowerShell\7-preview\pwsh.exe'
Image|endswith: ':\Program Files\PowerShell\7\pwsh.exe'
Image|endswith: ':\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe'
Image|endswith: ':\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe'
Image|endswith: ':\Windows\SysWOW64\poqexec.exe'
Image|endswith: ':\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'
Image|endswith: ':\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe'
Image|endswith: ':\Windows\System32\poqexec.exe'
Image: 'C:\Windows\SysWOW64\msiexec.exe'
Image: 'C:\Windows\System32\msiexec.exe'
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
Image | ends_with |
|
Image | eq |
|
TargetFilename | match |
|
Neighbors
Stricter alternatives (narrower than this rule)
The rules below may be useful if you find the current rule is too noisy / lacks specificity.
- PowerShell Module File Created (adds 1 filter)