Sigma rule: Potential Binary Or Script Dropper Via PowerShell

Rule

Title

Potential Binary Or Script Dropper Via PowerShell

Status

test

Level

medium

Author

frack113, Nasreddine Bencherchali (Nextron Systems)

Date

2023-03-17

Modified

2025-07-04

File

rules/windows/file/file_event/file_event_win_powershell_drop_binary_or_script.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects PowerShell creating a binary executable or a script file.

Log source

product

windows

category

file_event

Detection

selection:
    Image|endswith:
        - '\powershell.exe'
        - '\powershell_ise.exe'
        - '\pwsh.exe'
    TargetFilename|endswith:
        - '.bat'
        - '.chm'
        - '.cmd'
        - '.com'
        - '.dll'
        - '.exe'
        - '.hta'
        - '.jar'
        - '.js'
        - '.ocx'
        - '.scr'
        - '.sys'
        - '.vbe'
        - '.vbs'
        - '.wsf'
filter_main_user_temp:
    TargetFilename|startswith: 'C:\Users\'
    TargetFilename|contains: '\AppData\Local\Temp\'
    TargetFilename|endswith:
        - '.dll'
        - '.exe'
filter_main_other_temp:
    # Example: C:\Windows\Temp\0DA9758B-4649-4969-9409-5CBDF193FB53\TransmogProvider.dll
    TargetFilename|startswith:
        - 'C:\Windows\Temp\'
        - 'C:\Windows\SystemTemp\'
    TargetFilename|endswith:
        - '.dll'
        - '.exe'
filter_main_powershell_module:
    TargetFilename|startswith: 'C:\Users\'
    TargetFilename|contains: '\WindowsPowerShell\Modules\' # C:\Users\xxxx\Documents\WindowsPowerShell\Modules\powershell-yaml\0.4.12\lib\net47\PowerShellYamlSerializer.dll
    TargetFilename|endswith: '.dll'
filter_main_nuget:
    TargetFilename|startswith: 'C:\Program Files\PackageManagement\ProviderAssemblies\nuget\'
    TargetFilename|endswith: '\Microsoft.PackageManagement.NuGetProvider.dll'
condition: selection and not 1 of filter_main_*

False positives (as the rule lists them)

• False positives will differ depending on the environment and scripts used. Apply additional filters accordingly.

Tags

• attack.persistence

References

• https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/file/file_event/file_event_win_powershell_drop_binary_or_script.yml