PowerShell PowerUp Write-Hijack DLL Abuse Creating .bat on Windows

Flags PowerShell creating .bat files consistent with PowerUp Write-Hijack DLL abuse on Windows.

FreeUnreviewedSigmahighv1

powershell-powerup-write-hijack-dll-abuse-creating-bat-on-windows-602a1f13

title: PowerShell PowerUp Write-Hijack DLL Abuse Creating .bat on Windows
id: eb4ba970-33fa-45b7-811c-df346c394bec
status: test
description: This rule identifies Windows file creation events where a PowerShell process (powershell.exe or pwsh.exe) creates a batch file with a .bat extension. This pattern aligns with PowerUp Write-Hijack DLL usage where a self-deleting .bat script can be generated to execute attacker-controlled commands. Telemetry relies on correlating the spawning process path with the created target batch filename ending in .bat.
references:
  - https://powersploit.readthedocs.io/en/latest/Privesc/Write-HijackDll/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_hktl_powerup_dllhijacking.yml
author: Subhash Popuri (@pbssubhash), Huntrule Team
date: 2021-08-21
modified: 2024-06-27
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.execution
  - attack.stealth
  - attack.t1574.001
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith:
      - \powershell.exe
      - \pwsh.exe
    TargetFilename|endswith: .bat
  condition: selection
falsepositives:
  - Any powershell script that creates bat files
level: high
license: DRL-1.1
related:
  - id: 602a1f13-c640-4d73-b053-be9a2fa58b96
    type: derived

What it detects

This rule identifies Windows file creation events where a PowerShell process (powershell.exe or pwsh.exe) creates a batch file with a .bat extension. This pattern aligns with PowerUp Write-Hijack DLL usage where a self-deleting .bat script can be generated to execute attacker-controlled commands. Telemetry relies on correlating the spawning process path with the created target batch filename ending in .bat.

Known false positives

Any powershell script that creates bat files

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.