Recon Information for Export with PowerShell

Title: Recon Information for Export with PowerShell
Status: test
Description:Once established within a system or network, an adversary may use automated techniques for collecting internal data
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1119/T1119.md
Author: frack113
Date: 2021-07-30
modified:2022-12-25
Tags:

• -'attack.collection'
• -'attack.t1119'

Logsource:

• product: windows
• category: ps_script
• definition: Requirements: Script Block Logging must be enabled

Detection:
  selection_action:
    ScriptBlockText|contains:
      -'Get-Service '
      -'Get-ChildItem '
      -'Get-Process '

  selection_redirect:
    ScriptBlockText|contains: '> $env:TEMP\'
  condition:all of selection*
Falsepositives:
  -Unknown
Level: medium