Powershell Install a DLL in System Directory

Title: Powershell Install a DLL in System Directory
Status: test
Description:Uses PowerShell to install/copy a file into a system directory such as "System32" or "SysWOW64"
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1556.002/T1556.002.md#atomic-test-1---install-and-register-password-filter-dll
Author: frack113, Nasreddine Bencherchali (Nextron Systems)
Date: 2021-12-27
modified:2024-01-22
Tags:

• -'attack.persistence'
• -'attack.credential-access'
• -'attack.defense-impairment'
• -'attack.t1556.002'

Logsource:

• product: windows
• category: ps_script
• definition: Requirements: Script Block Logging must be enabled

Detection:
  selection:
    ScriptBlockText|re: '(Copy-Item|cpi) .{2,128} -Destination .{1,32}\\Windows\\(System32|SysWOW64)'
  condition:selection
Falsepositives:
  -Unknown
Level: high