Detect PowerShell Profile in Microsoft Sentinel
Adversaries may establish persistence by placing malicious commands into a PowerShell profile. A PowerShell profile script is a script that runs when PowerShell starts and can be used as a logon script to customize user environments. PowerShell supports several profile locations including: $PROFILE (current user, current host), $PROFILE.AllUsersCurrentHost (all users, current host), $PROFILE.CurrentUserAllHosts (current user, all hosts), and $PROFILE.AllUsersAllHosts (all users, all hosts — the most powerful). Malicious profile content executes whenever an interactive PowerShell session is started, providing persistent code execution in the user's context.
MITRE ATT&CK
- Tactic
- Privilege Escalation Persistence
- Technique
- T1546 Event Triggered Execution
- Sub-technique
- T1546.013 PowerShell Profile
- Canonical reference
- https://attack.mitre.org/techniques/T1546/013/
KQL Detection Query
let ProfilePaths = dynamic([
"Microsoft.PowerShell_profile.ps1",
"Microsoft.VSCode_profile.ps1",
"Microsoft.PowerShellISE_profile.ps1",
"profile.ps1"
]);
let ProfileFolders = dynamic([
"WindowsPowerShell",
"PowerShell",
"Documents\\PowerShell",
"Documents\\WindowsPowerShell",
"C:\\Windows\\System32\\WindowsPowerShell",
"C:\\Windows\\SysWOW64\\WindowsPowerShell"
]);
DeviceFileEvents
| where Timestamp > ago(24h)
| where FileName in~ (ProfilePaths)
or (FolderPath has_any (ProfileFolders) and FileName endswith ".ps1")
| where ActionType in ("FileCreated", "FileModified")
| extend IsSystemProfile = FolderPath has_any (
"C:\\Windows\\System32\\WindowsPowerShell",
"C:\\Windows\\SysWOW64\\WindowsPowerShell"
)
| extend IsUserProfile = FolderPath has_any ("Documents", "Users")
| extend SuspiciousWriter = InitiatingProcessFileName !in~ (
"powershell.exe", "pwsh.exe", "notepad.exe", "code.exe", "devenv.exe",
"vim.exe", "nano.exe"
)
| project Timestamp, DeviceName, AccountName, ActionType, FileName, FolderPath,
IsSystemProfile, IsUserProfile, SuspiciousWriter,
InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by Timestamp descDetects modifications to PowerShell profile files across all profile locations. Monitors for creation or modification of known profile filenames (Microsoft.PowerShell_profile.ps1, profile.ps1) in PowerShell profile directories. Distinguishes between user-level profiles (Documents\WindowsPowerShell) and system-wide profiles (System32\WindowsPowerShell — affects all users, requires admin). Flags modifications by non-editor processes as suspicious.
Data Sources
Required Tables
False Positives & Tuning
- PowerShell module installation (Install-Module) that adds initialization code to profiles
- Developer tool setup scripts (Visual Studio Code, PowerShell extension, Posh-git, oh-my-posh) that add profile entries during installation
- IT administrators legitimately configuring PowerShell environment via profile files as part of system baseline
- Security tools that add their own functions or aliases to PowerShell profiles during installation
Other platforms for T1546.013
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Add Malicious Command to PowerShell Profile
Expected signal: File modification event (Sysmon 11) for the PowerShell profile file. Process creation for powershell.exe executing Add-Content. PowerShell ScriptBlock Log Event ID 4104 shows the appended content. On next PowerShell launch, Event ID 4104 will show Invoke-Expression and DownloadString.
- Test 2Create AllUsers PowerShell Profile with Persistence
Expected signal: File creation or modification event (Sysmon 11) for C:\Windows\System32\WindowsPowerShell\v1.0\profile.ps1. IsSystemProfile=true in detection. Process creation for powershell.exe with Add-Content. This is a high-severity detection — AllUsers profile modification.
- Test 3Verify Profile Persistence Execution
Expected signal: File modification event for PowerShell profile. Process creation for powershell.exe (child session). File creation event for profile_executed.txt in Temp — confirms execution. The spawned PowerShell process loads the profile and executes the New-Item command.
References (4)
- https://attack.mitre.org/techniques/T1546/013/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.013/T1546.013.md
- https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_profiles
- https://learn.microsoft.com/en-us/powershell/scripting/learn/shell/creating-profiles
Unlock Pro Content
Get the full detection package for T1546.013 including response playbook, investigation guide, and atomic red team tests.