Powershell Sensitive File Discovery

Title: Powershell Sensitive File Discovery
Status: test
Description:Detect adversaries enumerate sensitive files
References:
  -https://twitter.com/malmoeb/status/1570814999370801158
Author: frack113
Date: 2022-09-16
modified:None
Tags:

• -'attack.discovery'
• -'attack.t1083'

Logsource:

• product: windows
• category: ps_script
• definition: Requirements: Script Block Logging must be enabled

Detection:
  selection_action:
    ScriptBlockText|contains:
      -'ls'
      -'get-childitem'
      -'gci'

  selection_recurse:
    ScriptBlockText|contains: '-recurse'
  selection_file:
    ScriptBlockText|contains:
      -'.pass'
      -'.kdbx'
      -'.kdb'

  condition:all of selection_*
Falsepositives:
  -Unknown
Level: medium