PowerShell profile script written to a known profile path

Siemphony@siemphonylowT1546.013unverifiedPlaybook · Unexpected execution

Matches Sysmon file creation of a PowerShell profile script — profile.ps1 or a per-host Microsoft.PowerShell_profile.ps1/ISE/VSCode variant — landing in a WindowsPowerShell\ or PowerShell\ folder, the concrete half of AN1245 that a single event can carry; the analytic's other half, correlating the write with a later PowerShell launch that omits -NoProfile, spans two events and Sigma has no join for it. The match is anchored on the last two path segments rather than the full path because Documents is frequently OneDrive- or UNC-redirected, and a full-path match would silently miss every redirected profile. Both the per-user and the all-users ($PSHOME) locations are included, since either gives an adversary unattended code execution on every new PowerShell session. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0451, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

1title: PowerShell profile script written to a known profile path2id: f1cff0e9-c670-4857-b1cb-02b559290d5b3status: experimental4description: |5  Matches Sysmon file creation of a PowerShell profile script — profile.ps1 or a6  per-host Microsoft.PowerShell_profile.ps1/ISE/VSCode variant — landing in a7  WindowsPowerShell\ or PowerShell\ folder, the concrete half of AN1245 that a8  single event can carry; the analytic's other half, correlating the write with9  a later PowerShell launch that omits -NoProfile, spans two events and Sigma10  has no join for it. The match is anchored on the last two path segments11  rather than the full path because Documents is frequently OneDrive- or12  UNC-redirected, and a full-path match would silently miss every redirected13  profile. Both the per-user and the all-users ($PSHOME) locations are14  included, since either gives an adversary unattended code execution on every15  new PowerShell session.16  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0451, not hand-written and not tested by its author. Any lab result is on this rule's own page.17references:18  - https://attack.mitre.org/techniques/T1546/01319  - https://attack.mitre.org/detectionstrategies/DET045120author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)21date: 2026-08-1622tags:23  - attack.privilege-escalation24  - attack.persistence25  - attack.t1546.01326logsource:27  category: file_event28  product: windows29detection:30  selection:31    TargetFilename|endswith:32      - '\WindowsPowerShell\profile.ps1'33      - '\WindowsPowerShell\Microsoft.PowerShell_profile.ps1'34      - '\WindowsPowerShell\Microsoft.PowerShellISE_profile.ps1'35      - '\WindowsPowerShell\Microsoft.VSCode_profile.ps1'36      - '\PowerShell\profile.ps1'37      - '\PowerShell\Microsoft.PowerShell_profile.ps1'38      - '\PowerShell\Microsoft.VSCode_profile.ps1'39  condition: selection40falsepositives:41  - "A user customizing their own console appearance, aliases or module imports by editing profile.ps1 in a text editor or VS Code — the single most common event this path ever sees on a developer workstation."42  - "Endpoint management tooling (an MDM policy or GPO logon script) that centrally deploys a standard corporate profile.ps1 to the all-users PowerShell\\ path during provisioning."43  - "PowerShell module installers such as Oh My Posh or PSReadLine setup scripts that append an Import-Module line to the user's profile on first run."44level: low

Sentinel · KQL

Run this as a search.

DeviceFileEvents| where (FolderPath endswith "\\WindowsPowerShell\\profile.ps1" or FolderPath endswith "\\WindowsPowerShell\\Microsoft.PowerShell_profile.ps1" or FolderPath endswith "\\WindowsPowerShell\\Microsoft.PowerShellISE_profile.ps1" or FolderPath endswith "\\WindowsPowerShell\\Microsoft.VSCode_profile.ps1" or FolderPath endswith "\\PowerShell\\profile.ps1" or FolderPath endswith "\\PowerShell\\Microsoft.PowerShell_profile.ps1" or FolderPath endswith "\\PowerShell\\Microsoft.VSCode_profile.ps1")

Splunk · SPL

Run this as a search.

index=* (TargetFilename="*\\WindowsPowerShell\\profile.ps1" OR TargetFilename="*\\WindowsPowerShell\\Microsoft.PowerShell_profile.ps1" OR TargetFilename="*\\WindowsPowerShell\\Microsoft.PowerShellISE_profile.ps1" OR TargetFilename="*\\WindowsPowerShell\\Microsoft.VSCode_profile.ps1" OR TargetFilename="*\\PowerShell\\profile.ps1" OR TargetFilename="*\\PowerShell\\Microsoft.PowerShell_profile.ps1" OR TargetFilename="*\\PowerShell\\Microsoft.VSCode_profile.ps1")

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (TO_LOWER(file.path) LIKE "*\\\\windowspowershell\\\\profile.ps1" OR TO_LOWER(file.path) LIKE "*\\\\windowspowershell\\\\microsoft.powershell_profile.ps1" OR TO_LOWER(file.path) LIKE "*\\\\windowspowershell\\\\microsoft.powershellise_profile.ps1" OR TO_LOWER(file.path) LIKE "*\\\\windowspowershell\\\\microsoft.vscode_profile.ps1" OR TO_LOWER(file.path) LIKE "*\\\\powershell\\\\profile.ps1" OR TO_LOWER(file.path) LIKE "*\\\\powershell\\\\microsoft.powershell_profile.ps1" OR TO_LOWER(file.path) LIKE "*\\\\powershell\\\\microsoft.vscode_profile.ps1")

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,file_event,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="TargetFilename" type="pcre2">(?i)(\\WindowsPowerShell\\profile\.ps1$|\\WindowsPowerShell\\Microsoft\.PowerShell_profile\.ps1$|\\WindowsPowerShell\\Microsoft\.PowerShellISE_profile\.ps1$|\\WindowsPowerShell\\Microsoft\.VSCode_profile\.ps1$|\\PowerShell\\profile\.ps1$|\\PowerShell\\Microsoft\.PowerShell_profile\.ps1$|\\PowerShell\\Microsoft\.VSCode_profile\.ps1$)</field>    <description>PowerShell profile script written to a known profile path</description>    <mitre>      <id>T1546.013</id>    </mitre>  </rule></group>

At a glance

Logsource: file_event / windows
Level: low
Category: suspicious_powershell
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: f1cff0e9-c670-4857-b1cb-02b559290d5b

ATT&CKT1546.013

T1546.013PowerShell Profile

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Evidence

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Noise check0 of 3 fired

Fires on none of the 3 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 3 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1546.013, evaluated against their file_event events.

Using it

Tuning & false positivesexperimental · 3 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Add a companion file_change/EventID 2 selection over the same path list to close the in-place-edit gap, as the reviewer recommended. MITRE's ExecutionContext knob (elevated vs. SYSTEM) and ModuleOrScriptName knob (what the profile actually loads) both need content or process context this file-creation event doesn't carry — the first needs a correlated process launch, the second needs the file contents parsed. Neither is implemented. The reviewer also flagged that a fully custom $PROFILE path — MITRE's own ProfilePathList knob — sits entirely outside these fixed folder names and is invisible to a suffix match; there's no tuning fix short of a different detection strategy for that case.

Declared by the author

A user customizing their own console appearance, aliases or module imports by editing profile.ps1 in a text editor or VS Code — the single most common event this path ever sees on a developer workstation.
Endpoint management tooling (an MDM policy or GPO logon script) that centrally deploys a standard corporate profile.ps1 to the all-users PowerShell\ path during provisioning.
PowerShell module installers such as Oh My Posh or PSReadLine setup scripts that append an Import-Module line to the user's profile on first run.

Lessonsuspicious powershell

suspicious powershellAI draft — unreviewed

01 · What this rule detects

Creation of a PowerShell profile script — profile.ps1 or a host-specific Microsoft.PowerShell_profile.ps1/ISE/VSCode variant — landing in a WindowsPowerShell\ or PowerShell\ folder. A profile runs unattended every time a matching PowerShell host starts unless launched with -NoProfile, which is what makes writing one a persistence and privilege-escalation mechanism. AN1245's actual analytic correlates that file write with a later PowerShell process launch that omits -NoProfile, spanning a file-event channel and a process-creation channel plus the PowerShell operational log — Sigma has no cross-event join, so only the file-write leg is authored here.

02 · Telemetry you need

Sysmon EventID 1, configured to log this content — Sysmon's file monitoring is itself an allowlist of watched paths, so confirm profile directories are covered before reading silence as clean. The brief also lists Sysmon EventID 2 (file_change, modification) as a log source for AN1245, but this rule's logsource picks only file_event (creation, EventID 11) — a gap covered below, not incidental.

03 · How the logic works

Seven suffixes cover console, ISE and VS Code hosts, both the per-user Windows PowerShell 5.1 folder and the PowerShell 7 folder, and both the per-user and all-users ($PSHOME) locations — any one gives unattended code execution on every new session. The match anchors on the last two path segments, not the full path, because the parent Documents folder is frequently OneDrive- or UNC-redirected; a full-path match would silently miss every redirected profile. The reviewer confirmed TargetFilename is a genuine Sysmon EID 11 field and all seven names are real profile variants. The coverage gap the reviewer found: because the logsource is file_event only, an attacker who overwrites an already-existing profile in place — plausible for the all-users profile, which frequently already exists — generates a Sysmon EventID 2 modification, not a creation, and this rule never sees it. The description frames the rule as covering only "the concrete half" of AN1245 but never names which half of file observability (creation vs. modification) that excludes.

04 · Common false positives

A user customizing console appearance, aliases or module imports directly
MDM policy or GPO logon scripts centrally deploying a standard
Module installers such as Oh My Posh or PSReadLine setup appending an

05 · Detection maturity

tier_1: .** UNVERIFIED — derived from MITRE ATT&CK DET0451 and never executed against logs. The reviewer supported level: low as well-matched to the dominant benign case and raised no dispute against it — the open findings are coverage gaps, not calibration.
tier_2: means adding the EventID 2 leg and confirming the OneDrive-redirect assumption against real paths in the environment.
tier_3: means correlating the write with the following PowerShell launch and its -NoProfile flag, which is where MITRE's TimeWindow knob and ExecutionContext knob start to apply.

Share this rule

/u/siemphony/f1cff0e9-c670-4857-b1cb-02b559290d5b

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

PowerShell profile script written to a known profile path

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it