SigmaHQ/rules/windows/process_creation/win_powershell_renamed_ps.yml

title: Renamed Powershell.exe
status: experimental
description: Detects copying and renaming of powershell.exe before execution (RETEFE malware DOC/macro starting Sept 2018)
references:
    - https://attack.mitre.org/techniques/T1086/
    - https://isc.sans.edu/forums/diary/Maldoc+Duplicating+PowerShell+Prior+to+Use/24254/
tags:
    - attack.t1086
    - attack.execution
    - car.2013-05-009
author: Tom Ueltschi (@c_APT_ure)
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Description: Windows PowerShell
    exclusion_1:
        Image:
            - '*\powershell.exe'
            - '*\powershell_ise.exe'
    exclusion_2:
        Description: Windows PowerShell ISE
    condition: all of selection and not (1 of exclusion_*)
falsepositives:
    - penetration tests, red teaming
level: high