huntrule

Suspicious 32-bit PowerShell Executed From SysWOW64 (via process_creation)

PremiumReviewedSigma · Low · v1
Product
windows
Category
process_creation
Author
HuntRule
Published
2026-07-09
Updated
2026-08-28
AnalysisDetection

ATT&CK techniques

Execution

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects invocation of the 32-bit PowerShell binary from SysWOW64, a technique GuLoader uses to run shellcode inside a 32-bit host on 64-bit systems. While some legacy tooling calls this path, its use as a malware execution surface makes it worth surfacing for review.

Reporting behind it

Related detections9 linkedT1059.001 — drag to rearrange
Suspicious node.exe Execution Spawned by PowerShell
Suspicious PowerShell Spawned by mshta.exe in FakeSG Chain (via process_creation)
Suspicious Encoded PowerShell Using Base64 Stream Decompression Routines (via process_creation)
Malicious IIS Worker Process Spawning Command Shell for Webshell Reconnaissance (via process_creation)
Suspicious PowerShell Spawned by Windows Script Host during Scarlet Goldfinch Infection (via process_creation)
Suspicious PowerShell Launched by MSIX StartingScriptWrapper From WindowsApps via Process Creation (via process_creation)
Malicious Command Shell or PowerShell Spawned by Tomcat via Process Creation (via process_creation)
Suspicious PowerShell Download Cradle via IEX and DownloadString (via process_creation)
Suspicious Hidden PowerShell Spawned by MSHTA for Boot Persistence (via process_creation)
Suspicious 32-bit PowerShell Executed From SysWOW64 (via process_creation)
Pivot detection · T1059.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.