PowerShell Profile

let ProfilePaths = dynamic([
    "Microsoft.PowerShell_profile.ps1",
    "Microsoft.VSCode_profile.ps1",
    "Microsoft.PowerShellISE_profile.ps1",
    "profile.ps1"
  ]);
let ProfileFolders = dynamic([
    "WindowsPowerShell",
    "PowerShell",
    "Documents\\PowerShell",
    "Documents\\WindowsPowerShell",
    "C:\\Windows\\System32\\WindowsPowerShell",
    "C:\\Windows\\SysWOW64\\WindowsPowerShell"
  ]);
DeviceFileEvents
| where Timestamp > ago(24h)
| where FileName in~ (ProfilePaths)
  or (FolderPath has_any (ProfileFolders) and FileName endswith ".ps1")
| where ActionType in ("FileCreated", "FileModified")
| extend IsSystemProfile = FolderPath has_any (
    "C:\\Windows\\System32\\WindowsPowerShell",
    "C:\\Windows\\SysWOW64\\WindowsPowerShell"
  )
| extend IsUserProfile = FolderPath has_any ("Documents", "Users")
| extend SuspiciousWriter = InitiatingProcessFileName !in~ (
    "powershell.exe", "pwsh.exe", "notepad.exe", "code.exe", "devenv.exe",
    "vim.exe", "nano.exe"
  )
| project Timestamp, DeviceName, AccountName, ActionType, FileName, FolderPath,
         IsSystemProfile, IsUserProfile, SuspiciousWriter,
         InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by Timestamp desc

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
| where match(TargetFilename, "(?i)(Microsoft\.PowerShell_profile\.ps1|Microsoft\.VSCode_profile\.ps1|profile\.ps1)")
   OR (match(TargetFilename, "(?i)(WindowsPowerShell|\\PowerShell\\)") AND match(TargetFilename, "\.ps1$"))
| eval IsSystemProfile=if(match(TargetFilename, "(?i)(System32|SysWOW64)\\\\WindowsPowerShell"), 1, 0)
| eval IsUserProfile=if(match(TargetFilename, "(?i)(Documents|Users)"), 1, 0)
| eval SuspiciousWriter=if(
    NOT match(lower(Image), "(powershell|pwsh|notepad|code\.exe|devenv|vim|nano)"),
    1, 0
  )
| table _time, host, User, TargetFilename, Image, CommandLine, IsSystemProfile, IsUserProfile, SuspiciousWriter
| sort - _time

file where event.action in ("creation", "overwrite", "rename") and (
  file.name in~ ("Microsoft.PowerShell_profile.ps1", "Microsoft.VSCode_profile.ps1", "Microsoft.PowerShellISE_profile.ps1", "profile.ps1")
  or (
    file.path like~ "*WindowsPowerShell*" and file.name like~ "*.ps1"
  )
  or (
    file.path like~ "*\\PowerShell\\*" and file.name like~ "*.ps1"
  )
) and not process.name in~ (
  "powershell.exe", "pwsh.exe", "notepad.exe", "code.exe",
  "devenv.exe", "vim.exe", "nano.exe", "notepad++.exe", "sublime_text.exe"
)

SELECT
  DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
  logsourcename(logsourceid) AS log_source,
  "sourceip",
  "username",
  "filename",
  QIDNAME(qid) AS event_name,
  "filepath",
  "processname",
  "processcommandline"
FROM events
WHERE
  LOGSOURCETYPEID(logsourceid) IN (12, 119)
  AND devicetime > (CURRENT_TIMESTAMP - 86400000)
  AND (
    LOWER("filename") IN (
      'microsoft.powershell_profile.ps1',
      'microsoft.vscode_profile.ps1',
      'microsoft.powershellise_profile.ps1',
      'profile.ps1'
    )
    OR (
      (LOWER("filepath") LIKE '%windowspowershell%' OR LOWER("filepath") LIKE '%\powershell\%')
      AND LOWER("filename") LIKE '%.ps1'
    )
  )
  AND qid IN (
    SELECT id FROM qidmap WHERE name LIKE '%File Created%' OR name LIKE '%File Modified%' OR name LIKE '%Sysmon%FileCreate%'
  )
  AND LOWER("processname") NOT IN (
    'powershell.exe', 'pwsh.exe', 'notepad.exe', 'code.exe',
    'devenv.exe', 'vim.exe', 'nano.exe'
  )
ORDER BY devicetime DESC

_sourceCategory=windows/sysmon OR _sourceCategory=os/windows/sysmon
| parse xml "*" as sysmon_xml nodrop
| json auto
| where EventID = "11"
| where (
    matches(TargetFilename, "(?i)Microsoft\.PowerShell_profile\.ps1") or
    matches(TargetFilename, "(?i)Microsoft\.VSCode_profile\.ps1") or
    matches(TargetFilename, "(?i)Microsoft\.PowerShellISE_profile\.ps1") or
    matches(TargetFilename, "(?i)(?:^|\\\\)profile\.ps1$") or
    (
      matches(TargetFilename, "(?i)(WindowsPowerShell|\\\\PowerShell\\\\)") and
      matches(TargetFilename, "(?i)\.ps1$")
    )
  )
| eval IsSystemProfile = if(matches(TargetFilename, "(?i)(System32|SysWOW64)\\\\WindowsPowerShell"), "true", "false")
| eval IsUserProfile = if(matches(TargetFilename, "(?i)(Documents|Users)"), "true", "false")
| eval SuspiciousWriter = if(
    !matches(toLowerCase(Image), "(powershell\.exe|pwsh\.exe|notepad\.exe|code\.exe|devenv\.exe|vim\.exe|nano\.exe)"),
    "true", "false"
  )
| where SuspiciousWriter = "true"
| fields _messagetime, Computer, User, TargetFilename, Image, CommandLine, IsSystemProfile, IsUserProfile, SuspiciousWriter
| sort by _messagetime desc

rule powershell_profile_persistence_t1546_013 {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects creation or modification of PowerShell profile scripts by unexpected processes (T1546.013 — Event Triggered Execution: PowerShell Profile)"
    severity = "HIGH"
    priority = "HIGH"
    mitre_attack_tactic = "Persistence"
    mitre_attack_technique = "T1546.013"
    reference = "https://attack.mitre.org/techniques/T1546/013/"
    version = "1.0"

  events:
    $e.metadata.event_type = "FILE_CREATION"
    $e.principal.hostname != ""
    (
      re.regex($e.target.file.full_path, `(?i)(Microsoft\.PowerShell_profile\.ps1|Microsoft\.VSCode_profile\.ps1|Microsoft\.PowerShellISE_profile\.ps1)`) or
      re.regex($e.target.file.full_path, `(?i)(^|\\)profile\.ps1$`) or
      (
        re.regex($e.target.file.full_path, `(?i)(WindowsPowerShell|\\PowerShell\\)`) and
        re.regex($e.target.file.full_path, `(?i)\.ps1$`)
      )
    )
    not re.regex($e.principal.process.file.full_path, `(?i)(powershell\.exe|pwsh\.exe|notepad\.exe|code\.exe|devenv\.exe|vim\.exe|nano\.exe|notepad\+\+\.exe|sublime_text\.exe)$`)

  condition:
    $e
}

#event_simpleName=WriteFile
| FilePath = /(?i)(Microsoft\.PowerShell_profile\.ps1|Microsoft\.VSCode_profile\.ps1|Microsoft\.PowerShellISE_profile\.ps1)/
  OR (FilePath = /(?i)(WindowsPowerShell|\\PowerShell\\)/ AND FilePath = /(?i)\.ps1$/)
  OR FilePath = /(?i)(^|\\)profile\.ps1$/
| IsSystemProfile := if(FilePath = /(?i)(System32|SysWOW64)\WindowsPowerShell/, "true", "false")
| IsUserProfile := if(FilePath = /(?i)(Documents|Users)/, "true", "false")
| SuspiciousWriter := if(
    ParentBaseFileName != /(?i)(powershell\.exe|pwsh\.exe|notepad\.exe|code\.exe|devenv\.exe|vim\.exe|nano\.exe)/,
    "true", "false"
  )
| SuspiciousWriter = "true"
| table([@timestamp, ComputerName, UserName, FilePath, ParentBaseFileName, ParentCommandLine, IsSystemProfile, IsUserProfile])
| sort(field=@timestamp, order=desc)