Sigma rule: PowerShell Profile Modification

Rule

Title

PowerShell Profile Modification

Status

test

Level

medium

Author

HieuTT35, Nasreddine Bencherchali (Nextron Systems)

Date

2019-10-24

Modified

2023-10-23

File

rules/windows/file/file_event/file_event_win_susp_powershell_profile.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the creation or modification of a powershell profile which could indicate suspicious activity as the profile can be used as a mean of persistence

Log source

product

windows

category

file_event

Detection

selection:
    TargetFilename|endswith:
        - '\Microsoft.PowerShell_profile.ps1'
        - '\PowerShell\profile.ps1'
        - '\Program Files\PowerShell\7-preview\profile.ps1'
        - '\Program Files\PowerShell\7\profile.ps1'
        - '\Windows\System32\WindowsPowerShell\v1.0\profile.ps1'
        - '\WindowsPowerShell\profile.ps1'
condition: selection

False positives (as the rule lists them)

• System administrator creating Powershell profile manually

Tags

• attack.persistence
• attack.privilege-escalation
• attack.t1546.013

MITRE ATT&CK ids this rule names

• T1546.013

References

• https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/
• https://persistence-info.github.io/Data/powershellprofile.html

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/file/file_event/file_event_win_susp_powershell_profile.yml