Possible Renamed Powershell Under Powershell Channel (via ps_classic_start)

title: Possible Renamed Powershell Under Powershell Channel (via ps_classic_start)
id: d83ff43c-9e69-51e4-8a0b-a60b5edf312d
status: stable
description: This rule detects a renamed Powershell execution, which is a common method used to circumvent security controls and bypass detection logic that's dependent on process names and process paths.
references:
    - https://attack.mitre.org/techniques/T1036/003/
    - https://attack.mitre.org/techniques/T1059/001/
    - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse
author: Huntrule Team
date: 2026-02-21
tags:
    - attack.execution
    - attack.stealth
    - attack.t1059.001
    - attack.t1036.003
logsource:
    product: windows
    category: ps_classic_start
detection:
    selection:
        Data|contains: 'HostName=ConsoleHost'
    filter_main_ps:
        Data|contains:
            - 'HostApplication=powershell'
            - 'HostApplication=C:\Windows\System32\WindowsPowerShell\v1.0\powershell'
            - 'HostApplication=C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell'
            - 'HostApplication=C:/Windows/System32/WindowsPowerShell/v1.0/powershell'
            - 'HostApplication=C:/Windows/SysWOW64/WindowsPowerShell/v1.0/powershell'
            - 'HostApplication=C:\\\\WINDOWS\\\\system32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe'
            - 'HostApplication=C:\\\\WINDOWS\\\\SysWOW64\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe'
    filter_main_host_application_null:
        Data|re: 'HostId=[a-zA-Z0-9-]{36}\s+EngineVersion='
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unknown
level: low