High Severity
Attachment: PowerShell Content
Description
Recursively scans files and archives to detect PowerShell content.
While scripts are often blocked by mail filtering, alternative file formats and archived content may be employed to bypass such controls.
References
type.inbound
and any(attachments,
(
.file_extension in~ (
// PowerShell related file extensions
"ps1",
"ps1xml",
"psm1",
"psd1",
"pssc",
"psrc",
"cdxml",
"ps2",
"ps2xml",
"psc2",
)
or .file_extension in~ $file_extensions_common_archives
)
and any(file.explode(.),
.file_extension in~ (
"ps1",
"ps1xml",
"psm1",
"psd1",
"pssc",
"psrc",
"cdxml",
"ps2",
"ps2xml",
"psc2",
)
)
)
Playground
Test against your own EMLs or sample data.