PowerShell Sensitive File Discovery Technique

This technique involves the use of PowerShell cmdlets to perform recursive directory searches specifically targeting sensitive file extensions associated with password managers and credential stores. Adversaries often execute these commands post-compromise to locate, exfiltrate, or harvest credentials necessary for privilege escalation or lateral movement. By leveraging cmdlets such as Get-ChildItem with recursion enabled, attackers can efficiently identify high-value targets across diverse directory structures on a compromised Windows host. Detection of this activity relies on monitoring PowerShell Script Block Logging, as these commands are frequently executed within volatile memory or via one-liners that bypass traditional file-system logging.

Attack Chain

1. Initial access is established through spearphishing or exploit delivery on the target system.
2. The attacker gains execution of a PowerShell instance or interactive shell.
3. The attacker identifies the current user context and file system structure.
4. The attacker executes a recursive search command (e.g., Get-ChildItem -Recurse) targeting specific patterns like ".kdbx" or ".pass".
5. The search identifies the absolute path to credential-related files on the disk.
6. The attacker reads or exfiltrates the discovered sensitive files to a C2-controlled endpoint.

Impact

Successful discovery of sensitive files can lead to the compromise of password databases and plain-text credential files, significantly increasing the risk of full account takeover, lateral movement across the network, and long-term persistence through harvested authentication tokens.

Recommendation

1. Enable PowerShell Script Block Logging (Event ID 4104) across all Windows endpoints to ensure the visibility of script execution.
2. Deploy the provided Sigma rule to detect recursive file searches targeting known credential file extensions.
3. Perform threat hunting for common PowerShell enumeration patterns and investigate high-frequency recursive search activity from unauthorized user accounts.