Automated Collection Bookmarks Using Get-ChildItem PowerShell
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Adversaries may enumerate browser bookmarks to learn more about compromised hosts. Browser bookmarks may reveal personal information about users (ex: banking sites, interests, social media, etc.) as well as details about internal network resources such as servers, tools/dashboards, or other related infrastructure.
Severity
Attention
Rule Requirement
Criteria
Action1: actionname = "PowerShell Script Block Logged" AND SCRIPTEXECUTED contains "Get-ChildItem" AND SCRIPTEXECUTED contains " -Recurse " AND SCRIPTEXECUTED contains " -Path " AND SCRIPTEXECUTED contains " -Filter Bookmarks" AND SCRIPTEXECUTED contains " -ErrorAction SilentlyContinue" AND SCRIPTEXECUTED contains " -Force" select Action1.HOSTNAME,Action1.MESSAGE,Action1.SCRIPTEXECUTED
Detection
Execution Mode
realtime
Log Sources
Windows
Author
frack113
