Detection of Automated PowerShell Data Collection

Adversaries often perform automated data collection to identify valuable information after gaining initial access to a compromised environment. By leveraging the built-in PowerShell capability 'Get-ChildItem', attackers can recursively search directories for specific file extensions associated with documents, such as .docx, .xlsx, .pdf, or .rtf. This technique allows for rapid discovery and staging of data without the need for manual browsing. Defenders should monitor for PowerShell scripts that combine recursive directory traversal with file-type filtering, as this pattern is a common indicator of automated reconnaissance and collection activity preceding exfiltration.

Attack Chain

1. Initial access is established on the Windows host via spearphishing or exploit.
2. The attacker opens a PowerShell session to execute discovery commands.
3. The adversary identifies a target directory for data harvesting.
4. The Get-ChildItem cmdlet is invoked with -Recurse and -Include parameters.
5. The command filters the search for specific document extensions (e.g., .docx, .pdf).
6. The system iterates through subdirectories to collect a list of target files.
7. Results are piped or redirected to a temporary staging file on the disk.
8. Collected files are compressed or prepared for exfiltration to an external C2 server.

Impact

Successful execution of automated collection allows an attacker to gain visibility into an organization's proprietary data, intellectual property, and sensitive user documentation. This stage is a prerequisite for data theft, which can lead to significant business disruption, regulatory penalties, and loss of competitive advantage.

Recommendation

1. Enable PowerShell Script Block Logging (Event ID 4104) across all endpoints to capture full command execution history.
2. Deploy the provided Sigma rule to detect recursive file searches targeting document extensions.
3. Investigate any PowerShell processes triggered by unexpected parent processes (e.g., web server services or document editors).
4. Review generated PowerShell logs for attempts to copy or move large volumes of files identified during the collection process.