{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/ma-ze/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":["MAZE"],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["medium"],"_cs_tags":["discovery","ransomware","powershell","windows","ma-ze"],"_cs_type":"threat","_cs_vendors":[],"content_html":"\u003cp\u003eThis detection brief addresses the use of PowerShell for unauthorized directory discovery and enumeration. Threat actors, specifically those associated with the MAZE ransomware, have been observed utilizing PowerShell scripts to map local and network file systems. By iterating through directories using cmdlets such as Get-ChildItem and redirecting the output to files, attackers can identify sensitive data for exfiltration or encryption. The technique is typically executed via living-off-the-land binaries to minimize footprint, making the monitoring of PowerShell Script Block Logging essential for identifying post-exploitation discovery activities in enterprise environments.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eInitial access is established via phishing or exploitation of internet-facing services.\u003c/li\u003e\n\u003cli\u003eThe attacker executes a PowerShell process via a web shell or other command-line entry point.\u003c/li\u003e\n\u003cli\u003eA script is invoked to enumerate directories to identify valuable data targets.\u003c/li\u003e\n\u003cli\u003eThe script uses 'Get-ChildItem' with 'foreach' loops to recursively scan folder structures.\u003c/li\u003e\n\u003cli\u003eThe attacker forces suppression of errors using '-ErrorAction SilentlyContinue' to prevent detection of permission issues.\u003c/li\u003e\n\u003cli\u003eResults of the directory scan are captured and redirected to a local text file using 'Out-File -append'.\u003c/li\u003e\n\u003cli\u003eThe collected metadata is exfiltrated to the attacker's C2 server.\u003c/li\u003e\n\u003cli\u003eThe final objective is reached through the subsequent encryption of identified directories.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful execution of this discovery technique allows attackers to map the environment, prioritize targets for data exfiltration, and systematically prepare for the deployment of ransomware. This increases the risk of data loss and operational downtime for organizations in all sectors.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eEnable PowerShell Script Block Logging (Event ID 4104) across all Windows endpoints to capture the full content of executing scripts.\u003c/li\u003e\n\u003cli\u003eDeploy the provided Sigma rule to identify common patterns of automated directory enumeration via PowerShell.\u003c/li\u003e\n\u003cli\u003eInvestigate the source of PowerShell commands that use redirection to hidden or temporary directories.\u003c/li\u003e\n\u003cli\u003eReview and restrict execution policy for PowerShell scripts to signed or approved administrative tasks.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-03T13:41:51Z","date_published":"2026-09-03T13:41:51Z","id":"https://feed.craftedsignal.io/briefs/2026-09-powershell-directory-enumeration/","summary":"Detection of PowerShell scripts utilizing specific cmdlets to recursively enumerate file system directories, a technique historically associated with MAZE ransomware discovery operations.","title":"PowerShell Directory Enumeration via MAZE Ransomware Tactics","url":"https://feed.craftedsignal.io/briefs/2026-09-powershell-directory-enumeration/"}],"language":"en","title":"CraftedSignal Threat Feed - Ma-Ze","version":"https://jsonfeed.org/version/1.1"}