Suspicious Alternate PowerShell Hosts - PowerShell Module (via ps_module)

title: Suspicious Alternate PowerShell Hosts - PowerShell Module (via ps_module)
id: 1f1f7a1b-c3ad-5681-ae50-0cc97252afea
status: stable
description: This rule detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe
references:
    - https://attack.mitre.org/techniques/T1059/001/
    - https://threathunterplaybook.com/hunts/windows/190610-PwshAlternateHosts/notebook.html
author: Huntrule Team
date: 2026-06-15
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    product: windows
    category: ps_module
    definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b
detection:
    selection:
        ContextInfo|contains: '*'
    filter_powershell:
        ContextInfo|contains:
            - '= powershell'
            - '= C:\Windows\System32\WindowsPowerShell\v1.0\powershell'
            - '= C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell'
            - '= C:/Windows/System32/WindowsPowerShell/v1.0/powershell'
            - '= C:/Windows/SysWOW64/WindowsPowerShell/v1.0/powershell'
            - '= \\\?\?\C:Windows\System32\WindowsPowerShell\v1.0\powershell'
            - '= \\\?\?\C:Windows\SysWOW64\WindowsPowerShell\v1.0\powershell'
    filter_sdiagnhost:
        ContextInfo|contains: '= C:\WINDOWS\System32\sdiagnhost.exe -Embedding'
    filter_citrix:
        ContextInfo|contains: 'ConfigSyncRun.exe'
    filter_adace:
        ContextInfo|contains: 'C:\Windows\system32\dsac.exe'
    filter_winrm:
        ContextInfo|contains: 'C:\Windows\system32\wsmprovhost.exe -Embedding'
    filter_help_update:
        Payload|contains:
            - 'Update-Help'
            - 'Failed to update Help for the module'
    filter_hr:
        ContextInfo|contains: MonitoringHost.exe
    condition: (selection and not 1 of filter_*) and not filter_hr
falsepositives:
    - Unknown
level: medium