Windows PowerShell: Start-Process with -PassThru and -FilePath

Alerts on PowerShell Start-Process calls that include -PassThru and -FilePath, based on ScriptBlockText matches.

FreeReviewedSigma · Medium · v2

Product: windows
Category: ps_script
Author: frack113 (SigmaHQ), DRL 1.1
Published: 2022-01-15
Updated: 2026-07-31

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1036.003Rename Legitimate Utilities
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies PowerShell script block content that uses Start-Process in combination with the -PassThru and -FilePath parameters. Attackers may use PassThru to obtain process objects while launching background or indirect execution, helping them chain follow-on activity. The detection relies on script block logging telemetry and matches specific parameter and cmdlet strings within ScriptBlockText.

Reporting behind it

Related detections9 linkedT1036.003 — drag to rearrange

Suspicious Renamed Tunneling Tool Executing from Windows Tasks Directory

Suspicious Renamed PowerShell Binary Execution (via process_creation)

Possible DarkGate Process Injection via iTunesHelper Spawning vbc.exe

Suspicious Renamed PowerShell Copied from System32 via Batch Loader

Suspicious Renamed PowerShell Binary Execution (via process_creation)

Renamed Autohotkey Binary

Suspicious Masqueraded Rundll32 with Mismatched Original Filename (via process_creation)

Suspicious Renamed git Binary gcmd.exe Execution (via process_creation)

Renamed Execution of a Renamed Windows System Utility (via process_creation)

Windows PowerShell: Start-Process with -PassThru and -FilePath

Pivot detection · T1036.003 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

powershell-start-process-with-passthru-and-filepath-in-scriptblock-logging-windo-0718cd72

title: "Windows PowerShell: Start-Process with -PassThru and -FilePath"
id: bce44bf0-f490-45eb-a1dc-9b9409c82a6a
status: test
description: This rule identifies PowerShell script block content that uses Start-Process in combination with the -PassThru and -FilePath parameters. Attackers may use PassThru to obtain process objects while launching background or indirect execution, helping them chain follow-on activity. The detection relies on script block logging telemetry and matches specific parameter and cmdlet strings within ScriptBlockText.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1036.003/T1036.003.md
  - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/start-process?view=powershell-7.6
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_start_process.yml
author: frack113, Huntrule Team
date: 2022-01-15
modified: 2026-05-18
tags:
  - attack.stealth
  - attack.t1036.003
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection_cmdlet:
    ScriptBlockText|contains:
      - "Start-Process "
      - "saps "
  selection_param:
    ScriptBlockText|contains|all:
      - "-PassThru "
      - "-FilePath "
  condition: all of selection_*
falsepositives:
  - Legitimate PowerShell scripts
level: medium
license: DRL-1.1
related:
  - id: 0718cd72-f316-4aa2-988f-838ea8533277
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL