Suspicious Windows PowerShell Child Processes Spawned by powershell.exe, pwsh.exe, or powershell_ise.exe

title: Suspicious Windows PowerShell Child Processes Spawned by powershell.exe, pwsh.exe, or powershell_ise.exe
id: 8e0cdcdc-8b18-4a0b-9a4e-ccb8297d6319
status: test
description: This rule flags Windows process creation events where PowerShell (powershell.exe, pwsh.exe, or powershell_ise.exe) spawns child processes matching a list of potentially dual-use or attacker-preferred executables such as certutil, mshta, wmic, rundll32, and schtasks. This matters because PowerShell is often used as an initial execution context to launch other tools for discovery, downloading, or living-off-the-land activity. The detection relies on process creation telemetry that provides parent and child image paths and command-line arguments, with selective exclusions for certain known Amazon WorkSpaces script paths and specific certutil and wmic command patterns.
references:
  - https://twitter.com/ankit_anubhav/status/1518835408502620162
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_powershell_susp_child_processes.yml
author: Florian Roth (Nextron Systems), Tim Shelton, Huntrule Team
date: 2022-04-26
modified: 2024-07-16
tags:
  - attack.execution
  - attack.t1059.001
  - detection.threat-hunting
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - \powershell_ise.exe
      - \powershell.exe
      - \pwsh.exe
    Image|endswith:
      - \bash.exe
      - \bitsadmin.exe
      - \certutil.exe
      - \cscript.exe
      - \forfiles.exe
      - \hh.exe
      - \mshta.exe
      - \regsvr32.exe
      - \rundll32.exe
      - \schtasks.exe
      - \scrcons.exe
      - \scriptrunner.exe
      - \sh.exe
      - \wmic.exe
      - \wscript.exe
  filter_optional_amazon:
    ParentCommandLine|contains: \Program Files\Amazon\WorkspacesConfig\Scripts\
    CommandLine|contains: \Program Files\Amazon\WorkspacesConfig\Scripts\
  filter_main_certutil_verify_store:
    Image|endswith: \certutil.exe
    CommandLine|contains: "-verifystore "
  filter_main_wmic:
    Image|endswith: \wmic.exe
    CommandLine|contains:
      - qfe list
      - "diskdrive "
      - "csproduct "
      - "computersystem "
      - " os "
      - ""
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - False positives are to be expected from PowerShell scripts that might make use of additional binaries such as "mshta", "bitsadmin", etc. Apply additional filters for those scripts.
level: medium
license: DRL-1.1
related:
  - id: e4b6d2a7-d8a4-4f19-acbd-943c16d90647
    type: derived