Execution of Powershell Script in Public Folder

Title: Execution of Powershell Script in Public Folder
Status: test
Description:This rule detects execution of PowerShell scripts located in the "C:\Users\Public" folder
References:
  -https://www.mandiant.com/resources/evolution-of-fin7
Author: Max Altgelt (Nextron Systems)
Date: 2022-04-06
modified:2022-07-14
Tags:

• -'attack.execution'
• -'attack.t1059.001'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    Image|endswith:
      -'\powershell.exe'
      -'\pwsh.exe'

    CommandLine|contains:
      -'-f C:\Users\Public'
      -'-f "C:\Users\Public'
      -'-f %Public%'
      -'-fi C:\Users\Public'
      -'-fi "C:\Users\Public'
      -'-fi %Public%'
      -'-fil C:\Users\Public'
      -'-fil "C:\Users\Public'
      -'-fil %Public%'
      -'-file C:\Users\Public'
      -'-file "C:\Users\Public'
      -'-file %Public%'

  condition:selection
Falsepositives:
  -Unlikely
Level: high