Extracting Information with PowerShell

Title: Extracting Information with PowerShell
Status: test
Description:Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.001/T1552.001.md
Author: frack113
Date: 2021-12-19
modified:2022-12-25
Tags:

• -'attack.credential-access'
• -'attack.t1552.001'

Logsource:

• product: windows
• category: ps_script
• definition: Requirements: Script Block Logging must be enabled

Detection:
  selection:
    ScriptBlockText|contains|all:
      -'ls'
      -' -R'
      -'select-string '
      -'-Pattern '

  condition:selection
Falsepositives:
  -Unknown
Level: medium