1200KM / detection
T1546.013 PowerShell Profile — Detection Rules
Detection workspace for T1546.013 PowerShell Profile: 3 Sigma sources, 0 Atlas concepts and 0 anomaly models. No live detection validation.
Source-backed rule directory
- PowerShell Profile Modification · test · medium · {"product":"windows","category":"file_event"}
- VsCode Powershell Profile Modification · test · medium · {"product":"windows","category":"file_event"}
- Potential Persistence Via PowerShell User Profile Using Add-Content · test · medium · {"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"}
Atlas deterministic concepts
No exact concept selected.
Anomaly models
No exact Atlas model in this snapshot.
ATT&CK analytic guidance
DET0451 Detection Strategy for PowerShell Profile Persistence via profile.ps1 Modification
AN1245 Analytic 1245
Defenders can identify PowerShell profile-based persistence by correlating file creation or modification in known profile locations with subsequent PowerShell process launches that do not use the `-NoProfile` flag. Profile scripts loading unusual modules or launching external programs, particularly under elevated contexts, are suspicious and may represent adversary persistence or privilege escalation.
Connected ecosystem references
Linked tags
Simulation, tools and telemetry
T1546.013 simulation workspace
No reviewed association in this snapshot.
Threat actor context
These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.
Existing anomaly research
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.