PowerShell Starts Processes Using Batch Script (.bat/.cmd) on Windows

Flags PowerShell Start-Process activity that references .bat/.cmd files, indicating batch script execution attempts.

FreeUnreviewedSigmamediumv1

powershell-starts-processes-using-batch-script-bat-cmd-on-windows-b5522a23

title: PowerShell Starts Processes Using Batch Script (.bat/.cmd) on Windows
id: b667e98f-3172-4454-adf6-cf6bcfe612b7
status: test
description: This rule identifies PowerShell script block content that invokes process creation via Start-Process while also referencing batch script extensions (.bat and/or .cmd). Attackers commonly use batch files to run sequences of commands or automate repetitive actions, and invoking them through PowerShell can help blend execution into administrative tooling. Telemetry relies on Windows PowerShell Script Block Logging capturing the ScriptBlockText that contains both Start-Process and the batch file indicators.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1059.003/T1059.003.md#atomic-test-1---create-and-execute-batch-script
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_execute_batch_script.yml
author: frack113, Huntrule Team
date: 2022-01-02
tags:
  - attack.execution
  - attack.t1059.003
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection_start:
    ScriptBlockText|contains: Start-Process
  selection_batch:
    ScriptBlockText|contains:
      - .cmd
      - .bat
  condition: all of selection_*
falsepositives:
  - Legitimate administration script
level: medium
license: DRL-1.1
related:
  - id: b5522a23-82da-44e5-9c8b-e10ed8955f88
    type: derived

What it detects

This rule identifies PowerShell script block content that invokes process creation via Start-Process while also referencing batch script extensions (.bat and/or .cmd). Attackers commonly use batch files to run sequences of commands or automate repetitive actions, and invoking them through PowerShell can help blend execution into administrative tooling. Telemetry relies on Windows PowerShell Script Block Logging capturing the ScriptBlockText that contains both Start-Process and the batch file indicators.

Known false positives

Legitimate administration script

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.