SigmaHQ/rules/windows/process_creation/win_susp_ps_appdata.yml

title: PowerShell Script Run in AppData
id: ac175779-025a-4f12-98b0-acdaeb77ea85
status: experimental
description: Detects a suspicious command line execution that invokes PowerShell with reference to an AppData folder
references:
    - https://twitter.com/JohnLaTwC/status/1082851155481288706
    - https://app.any.run/tasks/f87f1c4e-47e2-4c46-9cf4-31454c06ce03
tags:
    - attack.execution
    - attack.t1059.001
    - attack.t1086      # an old one
author: Florian Roth, Jonhnathan Ribeiro, oscd.community
date: 2019/01/09
modified: 2020/11/28
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains|all:
            - '/c'
            - 'powershell'
            - '\AppData\'
        CommandLine|contains:
            - 'Local\'
            - 'Roaming\'
    condition: selection
falsepositives:
    - Administrative scripts
level: medium
Converted Sysmon/1 and Security/4688 to generic process creation rules 2019-01-16 22:36:31 +00:00			`title: PowerShell Script Run in AppData`
Added UUIDs to rules 2019-11-12 22:12:27 +00:00			`id: ac175779-025a-4f12-98b0-acdaeb77ea85`
Converted Sysmon/1 and Security/4688 to generic process creation rules 2019-01-16 22:36:31 +00:00			`status: experimental`
			`description: Detects a suspicious command line execution that invokes PowerShell with reference to an AppData folder`
			`references:`
Increased indentation to 4 * Converted (to generic sigma) rules * Converter outputs by default with indentation 4 2019-03-01 23:14:20 +00:00			`- https://twitter.com/JohnLaTwC/status/1082851155481288706`
			`- https://app.any.run/tasks/f87f1c4e-47e2-4c46-9cf4-31454c06ce03`
atc review 2019-03-06 04:25:12 +00:00			`tags:`
			`- attack.execution`
Initial round of subtechnique updates 2020-06-16 20:46:08 +00:00			`- attack.t1059.001`
Fixes and improvements 2021-04-02 22:00:43 +00:00			`- attack.t1086 # an old one`
Update win_susp_ps_appdata.yml 2020-11-28 16:34:34 +00:00			`author: Florian Roth, Jonhnathan Ribeiro, oscd.community`
Converted Sysmon/1 and Security/4688 to generic process creation rules 2019-01-16 22:36:31 +00:00			`date: 2019/01/09`
Update win_susp_ps_appdata.yml 2020-11-28 16:34:34 +00:00			`modified: 2020/11/28`
Converted Sysmon/1 and Security/4688 to generic process creation rules 2019-01-16 22:36:31 +00:00			`logsource:`
Increased indentation to 4 * Converted (to generic sigma) rules * Converter outputs by default with indentation 4 2019-03-01 23:14:20 +00:00			`category: process_creation`
			`product: windows`
Converted Sysmon/1 and Security/4688 to generic process creation rules 2019-01-16 22:36:31 +00:00			`detection:`
Increased indentation to 4 * Converted (to generic sigma) rules * Converter outputs by default with indentation 4 2019-03-01 23:14:20 +00:00			`selection:`
Update win_susp_ps_appdata.yml 2020-11-28 16:15:24 +00:00			`CommandLine\|contains\|all:`
			`- '/c'`
			`- 'powershell'`
Update win_susp_ps_appdata.yml 2020-11-28 16:34:34 +00:00			`- '\AppData\'`
Update win_susp_ps_appdata.yml 2020-10-15 22:43:37 +00:00			`CommandLine\|contains:`
Update win_susp_ps_appdata.yml 2020-11-28 16:34:34 +00:00			`- 'Local\'`
			`- 'Roaming\'`
Increased indentation to 4 * Converted (to generic sigma) rules * Converter outputs by default with indentation 4 2019-03-01 23:14:20 +00:00			`condition: selection`
Converted Sysmon/1 and Security/4688 to generic process creation rules 2019-01-16 22:36:31 +00:00			`falsepositives:`
Increased indentation to 4 * Converted (to generic sigma) rules * Converter outputs by default with indentation 4 2019-03-01 23:14:20 +00:00			`- Administrative scripts`
Converted Sysmon/1 and Security/4688 to generic process creation rules 2019-01-16 22:36:31 +00:00			`level: medium`