Técnica MITRE ATT&CK · Escalada de privilegios, Persistencia

`T1546.013` PowerShell Profile

Subtécnica de T1546 Event Triggered Execution

Adversaries may gain persistence and elevate privileges by executing malicious content triggered by PowerShell profiles. A PowerShell profile (profile.ps1) is a script that runs when [PowerShell](https://attack.mitre.org/techniques/T1059/001) starts and can be used as a logon script to customize user environments. [PowerShell](https://attack.mitre.org/techniques/T1059/001) supports several…

Ficha en MITRE ATT&CK ↗

Quién la usa · con noticias en Jábega

Turla

Reglas Sigma para cazarla

Potential Persistence Via PowerShell User Profile Using Add-Contentmediumtest · windows
PowerShell Profile Modificationmediumtest · windows
VsCode Powershell Profile Modificationmediumtest · windows

Reglas de SigmaHQ · Detection Rule License 1.1. Técnica de MITRE ATT&CK®.