Automated Collection Bookmarks Using Get-ChildItem PowerShell
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Adversaries may enumerate browser bookmarks to learn more about compromised hosts. Browser bookmarks may reveal personal information about users (ex: banking sites, interests, social media, etc.) as well as details about internal network resources such as servers, tools/dashboards, or other related infrastructure.
Severity
Attention
Rule Requirement
Criteria
Action1:
actionname = "PowerShell Script Block Logged" AND SCRIPTEXECUTED contains "Get-ChildItem" AND SCRIPTEXECUTED contains " -Recurse " AND SCRIPTEXECUTED contains " -Path " AND SCRIPTEXECUTED contains " -Filter Bookmarks" AND SCRIPTEXECUTED contains " -ErrorAction SilentlyContinue" AND SCRIPTEXECUTED contains " -Force"
select Action1.HOSTNAME,Action1.MESSAGE,Action1.SCRIPTEXECUTED,Action1.DOMAIN,Action1.PATH,Action1.USERNAME
Detection
Execution Mode
realtime
Log Sources
Windows
Author
frack113
