PowerShell Start-Process with -PassThru and -FilePath in ScriptBlock Logging (Windows)

Alerts on PowerShell Start-Process calls that include -PassThru and -FilePath, based on ScriptBlockText matches.

FreeUnreviewedSigmamediumv1

powershell-start-process-with-passthru-and-filepath-in-scriptblock-logging-windo-0718cd72

title: PowerShell Start-Process with -PassThru and -FilePath in ScriptBlock Logging (Windows)
id: bce44bf0-f490-45eb-a1dc-9b9409c82a6a
status: test
description: This rule flags PowerShell script blocks that invoke Start-Process while specifying both -PassThru and -FilePath. Using these options can support stealthier or more controlled process execution by starting a new process and returning a handle for subsequent actions. It relies on ScriptBlockText content from PowerShell script block logging to match the specific command and required parameters.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1036.003/T1036.003.md
  - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/start-process?view=powershell-7.6
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_start_process.yml
author: frack113, Huntrule Team
date: 2022-01-15
modified: 2026-05-18
tags:
  - attack.stealth
  - attack.t1036.003
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection_cmdlet:
    ScriptBlockText|contains:
      - "Start-Process "
      - "saps "
  selection_param:
    ScriptBlockText|contains|all:
      - "-PassThru "
      - "-FilePath "
  condition: all of selection_*
falsepositives:
  - Legitimate PowerShell scripts
level: medium
license: DRL-1.1
related:
  - id: 0718cd72-f316-4aa2-988f-838ea8533277
    type: derived

What it detects

This rule flags PowerShell script blocks that invoke Start-Process while specifying both -PassThru and -FilePath. Using these options can support stealthier or more controlled process execution by starting a new process and returning a handle for subsequent actions. It relies on ScriptBlockText content from PowerShell script block logging to match the specific command and required parameters.

Known false positives

Legitimate PowerShell scripts

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.