PowerShell Directory Enumeration with Output to File

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•21

This rule detects PowerShell scripts that enumerate directories using `Get-ChildItem` and output the results to a file using `Out-File -append`. The detection logic specifically looks for the combination of `foreach`, `Get-ChildItem`, `-Path`, `-ErrorAction SilentlyContinue`, `Out-File`, and `-append` within the PowerShell script block text. This behavior has been associated with MAZE ransomware for directory discovery.