SigmaHQ/rules/windows/powershell/powershell_suspicious_profile_create.yml

title: 'Powershell profile modify'
status: experimental
description: 'Detects a change in profile.ps1 of Powershell profile'
references:
    - 'https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/'
author: HieuTT35
date: 2019/10/24
logsource:
    product: windows
    service: sysmon
detection:
    event:
      EventID: 11
    target1:
      TargetFilename|re: '.*\\My Documents\\PowerShell\\(Microsoft\.)?.*(Profile|profile)\.ps1'
    target2:
      TargetFilename|re: 'C\:\\Windows\\System32\\WindowsPowerShell\\v1\.0\\(Microsoft\.)?.*(Profile|profile)\.ps1'
    condition: event and (target1 or target2)
falsepositives:
    - 'System administrator create Powershell profile manually'
level: high
tags:
    - attack.persistence
    - attack.privilege_escalation