T1546.013 — PowerShell Profile

Tactics: Privilege Escalation, Persistence · Platforms: Windows

Adversaries may gain persistence and elevate privileges by executing malicious content triggered by PowerShell profiles. A PowerShell profile (profile.ps1) is a script that runs when PowerShell starts and can be used as a logon script to customize user environments. PowerShell supports several…

Sub-technique of Event Triggered Execution (T1546).

Sigma detection rules (1)

T1546.013 Event Triggered Execution: PowerShell Profile

title: "T1546.013 Event Triggered Execution: PowerShell Profile"
id: f4d4fcff-23ea-408b-9d30-f0af3fc9eb4b
description: 'Detection Strategy for PowerShell Profile Persistence via profile.ps1 Modification. (Data Component: File Creation; baseline tier: windows-eventid.) Tune using: ProfilePathList, ExecutionContext, ModuleOrScriptName, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1546/013
author: Shahrukh Khan
date: 2026-02-21
license: MIT
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1546.013

logsource:
  category: file_event
  product: windows
  service: sysmon

detection:
  selection:
    EventID: '11'
    TargetFilename|endswith:
      - '\profile.ps1'
      - '\Microsoft.PowerShell_profile.ps1'
      - '\Microsoft.PowerShellISE_profile.ps1'
      - '\Microsoft.VSCode_profile.ps1'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'
  condition: selection and not filter_system_account

falsepositives:
  - Administrators or software installers legitimately creating/editing PowerShell/ISE/VSCode profile scripts.

level: medium

Related sub-techniques

Explore