PowerShell Sensitive File Discovery
This rule detects PowerShell commands that attempt to discover sensitive files by looking for common file extensions associated with credentials or password managers (e.g., .pass, .kdbx, .kdb). It specifically targets commands like 'ls', 'get-childitem', or 'gci' combined with the '-recurse' parameter, indicating a recursive search for these sensitive file types.
Sigma
