Windows PowerShell: Start-Process with -PassThru and -FilePath
Alerts on PowerShell Start-Process calls that include -PassThru and -FilePath, based on ScriptBlockText matches.
- Product
- windows
- Category
- ps_script
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-01-15
- Updated
- 2026-07-31
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies PowerShell script block content that uses Start-Process in combination with the -PassThru and -FilePath parameters. Attackers may use PassThru to obtain process objects while launching background or indirect execution, helping them chain follow-on activity. The detection relies on script block logging telemetry and matches specific parameter and cmdlet strings within ScriptBlockText.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1036.003/T1036.003.md
- learn.microsoft.comhttps://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/start-process?view=powershell-7.6
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_start_process.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows PowerShell: Start-Process with -PassThru and -FilePath"
id: bce44bf0-f490-45eb-a1dc-9b9409c82a6a
status: test
description: This rule identifies PowerShell script block content that uses Start-Process in combination with the -PassThru and -FilePath parameters. Attackers may use PassThru to obtain process objects while launching background or indirect execution, helping them chain follow-on activity. The detection relies on script block logging telemetry and matches specific parameter and cmdlet strings within ScriptBlockText.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1036.003/T1036.003.md
- https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/start-process?view=powershell-7.6
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_start_process.yml
author: frack113, Huntrule Team
date: 2022-01-15
modified: 2026-05-18
tags:
- attack.stealth
- attack.t1036.003
logsource:
product: windows
category: ps_script
definition: "Requirements: Script Block Logging must be enabled"
detection:
selection_cmdlet:
ScriptBlockText|contains:
- "Start-Process "
- "saps "
selection_param:
ScriptBlockText|contains|all:
- "-PassThru "
- "-FilePath "
condition: all of selection_*
falsepositives:
- Legitimate PowerShell scripts
level: medium
license: DRL-1.1
related:
- id: 0718cd72-f316-4aa2-988f-838ea8533277
type: derived