huntrule

Malicious Masquerading TiWorker Spawning PowerShell Downloader via process_creation

PremiumReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
HuntRule
Published
2026-09-17
Updated
2026-09-17
AnalysisDetection

ATT&CK techniques

Execution → Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects a masquerading TiWorker.exe process spawning PowerShell to fetch a remotely hosted payload disguised as a PNG image, matching the GHOSTENGINE crypto mining infection chain. The legitimate TiWorker.exe is a Windows Modules Installer worker and does not normally launch PowerShell download activity. This behavior indicates process masquerading for initial payload retrieval.

Reporting behind it

Related detections9 linkedT1059.001 — drag to rearrange
Malicious Renamed PowerShell as wt.exe in ProgramData via Axios Compromise
Malicious PowerShell Masquerading as wt.exe in ProgramData via Axios npm Compromise (via process_creation)
Malicious Axios NPM RAT Renamed PowerShell Execution via wt.exe
Windows: Process executions matching Greenbug espionage tool indicators
Malicious PowerShell Executing Script From Public Directory via WScript
Suspicious Execution of ELF Masquerading as Build Artifact
Suspicious PowerShell Executing Payload From Roaming AppData via Command Line (via process_creation)
Suspicious PowerShell Spawning mshta for Malware Execution (via process_creation)
Malicious SolarWinds BusinessLayerHost Spawning Suspicious Child Process (SUNBURST) (via process_creation)
Malicious Masquerading TiWorker Spawning PowerShell Downloader via process_creation
Pivot detection · T1059.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.