Windows PowerShell Starts Process Using Batch (.cmd/.bat) Scripts

Flags PowerShell Start-Process activity that references .bat/.cmd files, indicating batch script execution attempts.

FreeReviewedSigma · Medium · v2

Product: windows
Category: ps_script
Author: frack113 (SigmaHQ), DRL 1.1
Published: 2022-01-02
Updated: 2026-07-31

ATT&CK techniques

Execution

Recon
Resource Dev
Initial Access
Execution
- T1059.003Windows Command Shell
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies PowerShell script block activity where a Start-Process call is executed with references to Windows batch script extensions (.cmd or .bat). Attackers commonly use batch files to run sequences of commands through the Windows command interpreter, often to automate execution steps or stage follow-on actions. The detection relies on Script Block Logging telemetry that contains the executed PowerShell script text.

Reporting behind it

Related detections9 linkedT1059.003 — drag to rearrange

Suspicious Doenerium Host Fingerprinting via cmd.exe

Suspicious Scheduled Task Creation Referencing dllFake Batch Scripts (via process_creation)

Suspicious Backup Exec Remote Agent Spawning Command Shell via Process Creation (via process_creation)

Suspicious ClickFix Command Execution via RunMRU Registry Key

Suspicious LampoRAT Command Dispatcher via Cmd Delayed Expansion Flags (via process_creation)

Malicious WSUS Service Spawning Command Shell via CVE-2025-59287 (via process_creation)

Malicious SharePoint w3wp Spawning Command Shell and PowerShell

Suspicious extrac32 CAB Extraction Abuse

Suspicious curl Spawning Script Host for Latrodectus Delivery

Windows PowerShell Starts Process Using Batch (.cmd/.bat) Scripts

Pivot detection · T1059.003 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

powershell-starts-processes-using-batch-script-bat-cmd-on-windows-b5522a23

title: Windows PowerShell Starts Process Using Batch (.cmd/.bat) Scripts
id: b667e98f-3172-4454-adf6-cf6bcfe612b7
status: test
description: This rule identifies PowerShell script block activity where a Start-Process call is executed with references to Windows batch script extensions (.cmd or .bat). Attackers commonly use batch files to run sequences of commands through the Windows command interpreter, often to automate execution steps or stage follow-on actions. The detection relies on Script Block Logging telemetry that contains the executed PowerShell script text.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1059.003/T1059.003.md#atomic-test-1---create-and-execute-batch-script
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_execute_batch_script.yml
author: frack113, Huntrule Team
date: 2022-01-02
tags:
  - attack.execution
  - attack.t1059.003
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection_start:
    ScriptBlockText|contains: Start-Process
  selection_batch:
    ScriptBlockText|contains:
      - .cmd
      - .bat
  condition: all of selection_*
falsepositives:
  - Legitimate administration script
level: medium
license: DRL-1.1
related:
  - id: b5522a23-82da-44e5-9c8b-e10ed8955f88
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL