PowerShell Script Run in AppData

Severity: medium
Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community
Source: upstream

Detects a suspicious command line execution that invokes PowerShell with reference to an AppData folder

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1059.001` Command and Scripting Interpreter: PowerShell

Event coverage

Provider	Event ID	Title
Sysmon	1	Process creation
Security-Auditing	4688	A new process has been created.

Stages and Predicates

Stage 1: `all of selection1`

or:
CommandLine|contains: '\powershell'
CommandLine|contains: '\pwsh'
CommandLine|contains: powershell.exe
CommandLine|contains: pwsh.exe

Stage 2: `all of selection2`

or:
CommandLine|contains: 'Local\'
CommandLine|contains: 'Roaming\'
CommandLine|contains: '/c '
CommandLine|contains: '\AppData\'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`CommandLine`	match	`/c` corpus 2 (sigma 2) `Local\` `Roaming\` `\AppData\` corpus 8 (sigma 8) `\powershell` `\pwsh` `powershell.exe` corpus 2 (sigma 2) `pwsh.exe` corpus 2 (sigma 2)