Suspicious Execution of AgentExecutor PowerShell (via process_creation)

title: Suspicious Execution of AgentExecutor PowerShell (via process_creation)
id: 5fc9a51f-e057-525b-822f-0719814ab9f5
status: stable
description: This rule detects execution of the AgentExecutor.exe binary. That can be misused as a LOLBIN to execute powershell scripts with the ExecutionPolicy "Bypass" or any binary named "powershell.exe" located in the path provided by 6th positional argument
author: Huntrule Team
references:
    - https://attack.mitre.org/techniques/T1218/
    - https://twitter.com/lefterispan/status/1286259016436514816
    - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Agentexecutor/
    - https://learn.microsoft.com/en-us/mem/intune/apps/intune-management-extension
    - https://twitter.com/jseerden/status/1247985304667066373/photo/1
date: 2026-04-15
tags:
    - attack.stealth
    - attack.t1218
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image: '\AgentExecutor.exe'
        - OriginalFileName: 'AgentExecutor.exe'
    selection_cli:
        CommandLine|contains:
            - ' -powershell'
            - ' -remediationScript'
    filter_main_intune:
        ParentImage|endswith: '\Microsoft.Management.Services.IntuneWindowsAgent.exe'
    condition: all of selection_* and not 1 of filter_main_*
falsepositives:
    - Unknown
level: medium