Suspicious File Creation via PowerShell

This brief addresses the detection of PowerShell processes (powershell.exe, powershell_ise.exe, pwsh.exe) creating files with suspicious extensions, such as .exe, .dll, .bat, or .vbs. Attackers frequently utilize PowerShell to drop secondary payloads, stage malicious scripts, or install persistence mechanisms on compromised Windows systems. While legitimate administrative scripts and software installers may perform similar actions, the monitoring of file creation events in sensitive or unexpected locations is a critical component for identifying malicious dropper activity. Defenders should baseline existing automated scripts within their environment to tune out known-good behavior while focusing on file creation events occurring outside of typical application installation paths.

Impact

Successful exploitation by a file dropper allows attackers to maintain persistence, execute secondary payloads, and facilitate lateral movement or data exfiltration. Failure to monitor these activities can result in the undetected deployment of remote access trojans (RATs), ransomware, or information stealers.

Recommendation

Deploy the provided Sigma rule to identify unauthorized file writes triggered by PowerShell processes. Enable Sysmon file_event (Event ID 11) or equivalent EDR telemetry for file creation monitoring. Tune the detection by identifying and adding legitimate enterprise software deployment paths or internal script repositories to the filter list.