PowerShell Automated Document Collection

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•20

This rule detects PowerShell commands that use `Get-ChildItem` with `-Recurse` and `-Include` parameters to search for common document and archive file extensions. This behavior is indicative of an adversary attempting to automatically collect sensitive data from a system or network.