Sigma rule: Extracting Information with PowerShell

A detection rule from the SigmaHQ repository, shown as its author published it. Dataset version ref-6c0aa365dbbd, updated 2022-12-25T00:00:00.000Z.

Rule

Title: Extracting Information with PowerShell
Status: test
Level: medium
Author: frack113
Date: 2021-12-19
Modified: 2022-12-25
File: rules/windows/powershell/powershell_script/posh_ps_susp_extracting.yml
Commit: ccbb0369507f796db0b0ae6854c8a2be471b9d84

Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials.
These can be files created by users to store their own credentials, shared credential stores for a group of individuals,
configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.

Log source

product: windows
category: ps_script
definition: Requirements: Script Block Logging must be enabled

Detection

selection:
    ScriptBlockText|contains|all:
        - ls
        - ' -R'
        - 'select-string '
        - '-Pattern '
condition: selection

False positives (as the rule lists them)

Unknown

MITRE ATT&CK ids this rule names

T1552.001

References

https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.001/T1552.001.md

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/powershell/powershell_script/posh_ps_susp_extracting.yml

Sources and licences

SigmaHQ
"Extracting Information with PowerShell" by frack113 (SigmaHQ). Rule: https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/powershell/powershell_script/posh_ps_susp_extracting.yml.
Licensed under the Detection Rule License (DRL) 1.1: https://github.com/SigmaHQ/Detection-Rule-License
Detection Rule License (DRL) 1.1

Cite this page

Dragons Eye Ransomware Tracker, "Sigma rule: Extracting Information with PowerShell",
entity page, dataset version ref-6c0aa365dbbd, updated 2022-12-25T00:00:00.000Z,
https://ransomware-tracker.com/detections/sigma/bd5971a7-626d-46ab-8176-ed643f694f68 (accessed 2026-11-03).
Underlying source: SigmaHQ rule bd5971a7-626d-46ab-8176-ed643f694f68, commit ccbb0369507f796db0b0ae6854c8a2be471b9d84.

Pages change. The dataset version identifies the data, but no archive of old versions is kept, so this citation cannot be replayed later.