{"id":"ac175779-025a-4f12-98b0-acdaeb77ea85","title":"PowerShell Script Run in AppData","description":"Detects a suspicious command line execution that invokes PowerShell with reference to an AppData folder","author":"Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community","status":"test","level":"medium","date":"2019-01-09","modified":"2022-07-14","tags":["attack.execution","attack.t1059.001"],"technique_ids":["T1059.001"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Administrative scripts"],"references":["https://twitter.com/JohnLaTwC/status/1082851155481288706","https://app.any.run/tasks/f87f1c4e-47e2-4c46-9cf4-31454c06ce03"],"source_path":"rules/windows/process_creation/proc_creation_win_powershell_susp_ps_appdata.yml","source_sha256":"91f7609837eff365d7ba7bef626275eca7e577e14cb4ae7493ea5b6de24dba17","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_powershell_susp_ps_appdata.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: PowerShell Script Run in AppData\nid: ac175779-025a-4f12-98b0-acdaeb77ea85\nstatus: test\ndescription: Detects a suspicious command line execution that invokes PowerShell with reference to an AppData folder\nreferences:\n    - https://twitter.com/JohnLaTwC/status/1082851155481288706\n    - https://app.any.run/tasks/f87f1c4e-47e2-4c46-9cf4-31454c06ce03\nauthor: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community\ndate: 2019-01-09\nmodified: 2022-07-14\ntags:\n    - attack.execution\n    - attack.t1059.001\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection1:\n        CommandLine|contains:\n            - 'powershell.exe'\n            - '\\powershell'\n            - '\\pwsh'\n            - 'pwsh.exe'\n    selection2:\n        CommandLine|contains|all:\n            - '/c '\n            - '\\AppData\\'\n        CommandLine|contains:\n            - 'Local\\'\n            - 'Roaming\\'\n    condition: all of selection*\nfalsepositives:\n    - Administrative scripts\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059.001","id":"T1059.001","name":"PowerShell","page":"techniques/enterprise/T1059.001/"}],"data_path":"data/detection-rules/ac175779-025a-4f12-98b0-acdaeb77ea85.json","kind":"sigma"}