PowerShell Security Software Discovery Using get-process Piped to where-object (Windows)
Flags PowerShell scripts that enumerate processes and filter results for security software by vendor/product keywords.
- Product
- windows
- Category
- ps_script
- Author
- frack113, Anish Bogati, Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2021-12-16
- Updated
- 2026-07-31
ATT&CK techniques
DiscoveryRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies PowerShell script blocks that enumerate running processes using get-process (or gps) and immediately pipe results to a where-object filter. It further looks for process property filters (e.g., Company/Description/Name/Path/Product) combined with keywords associated with security products and sensors such as antivirus, defender, and specific vendor terms. Such discovery can help attackers identify installed defensive tooling and tailor follow-on actions. The detection relies on ScriptBlockText content from PowerShell Script Block Logging.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1518.001/T1518.001.md#atomic-test-2---security-software-discovery---powershell
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_get_process_security_software_discovery.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: PowerShell Security Software Discovery Using get-process Piped to where-object (Windows)
id: 05e2dd76-f93b-4fc4-a14e-22616c8d934e
status: test
description: This rule identifies PowerShell script blocks that enumerate running processes using get-process (or gps) and immediately pipe results to a where-object filter. It further looks for process property filters (e.g., Company/Description/Name/Path/Product) combined with keywords associated with security products and sensors such as antivirus, defender, and specific vendor terms. Such discovery can help attackers identify installed defensive tooling and tailor follow-on actions. The detection relies on ScriptBlockText content from PowerShell Script Block Logging.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1518.001/T1518.001.md#atomic-test-2---security-software-discovery---powershell
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_get_process_security_software_discovery.yml
author: frack113, Anish Bogati, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2021-12-16
modified: 2023-10-24
tags:
- attack.discovery
- attack.t1518.001
logsource:
product: windows
category: ps_script
definition: "Requirements: Script Block Logging must be enabled"
detection:
selection_cmdlet:
ScriptBlockText|contains:
- get-process | \?
- get-process | where
- gps | \?
- gps | where
selection_field:
ScriptBlockText|contains:
- Company -like
- Description -like
- Name -like
- Path -like
- Product -like
selection_keywords:
ScriptBlockText|contains:
- \*avira\*
- \*carbonblack\*
- \*cylance\*
- \*defender\*
- \*kaspersky\*
- \*malware\*
- \*sentinel\*
- \*symantec\*
- \*virus\*
condition: all of selection_*
falsepositives:
- False positives might occur due to the nature of the ScriptBlock being ingested as a big blob. Initial tuning is required.
- As the "selection_cmdlet" is common in scripts the matching engine might slow down the search. Change into regex or a more accurate string to avoid heavy resource consumption if experienced
level: medium
license: DRL-1.1
related:
- id: 904e8e61-8edf-4350-b59c-b905fc8e810c
type: derived