Windows: Code execution via pester.bat spawned by PowerShell

Alerts when PowerShell spawns Pester.bat with parent command lines referencing Pester invocation or help usage.

FreeUnreviewedSigmamediumv1

windows-code-execution-via-pester-bat-spawned-by-powershell-18988e1b

title: "Windows: Code execution via pester.bat spawned by PowerShell"
id: ac81ad1e-e3a7-47f9-8a4e-5f5550bacdb9
related:
  - id: 59e938ff-0d6d-4dc3-b13f-36cc28734d4e
    type: similar
  - id: 18988e1b-9087-4f8a-82fe-0414dce49878
    type: derived
status: test
description: This rule flags process creation where a Pester.bat execution is launched with its parent being PowerShell (powershell.exe or pwsh.exe) and the parent command line includes the Pester module path. It also looks for PowerShell command-line patterns consistent with invoking Pester (Invoke-Pester with exit handling) or using Get-Help within a Pester context. This behavior matters because attackers can leverage PowerShell tooling to execute test/automation commands and blend into legitimate administrative activity. The detection relies on Windows process creation telemetry capturing the parent image and parent command line contents.
references:
  - https://twitter.com/Oddvarmoe/status/993383596244258816
  - https://twitter.com/_st0pp3r_/status/1560072680887525378
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_lolbin_pester.yml
author: frack113, Nasreddine Bencherchali, Huntrule Team
date: 2022-08-20
tags:
  - attack.execution
  - attack.stealth
  - attack.t1059.001
  - attack.t1216
logsource:
  category: process_creation
  product: windows
detection:
  selection_module:
    ParentImage|endswith:
      - \powershell.exe
      - \pwsh.exe
    ParentCommandLine|contains: \WindowsPowerShell\Modules\Pester\
  selection_cli:
    ParentCommandLine|contains:
      - "{ Invoke-Pester -EnableExit ;"
      - '{ Get-Help "'
  condition: all of selection_*
falsepositives:
  - Legitimate use of Pester for writing tests for Powershell scripts and modules
level: medium
license: DRL-1.1

What it detects

This rule flags process creation where a Pester.bat execution is launched with its parent being PowerShell (powershell.exe or pwsh.exe) and the parent command line includes the Pester module path. It also looks for PowerShell command-line patterns consistent with invoking Pester (Invoke-Pester with exit handling) or using Get-Help within a Pester context. This behavior matters because attackers can leverage PowerShell tooling to execute test/automation commands and blend into legitimate administrative activity. The detection relies on Windows process creation telemetry capturing the parent image and parent command line contents.

Known false positives

Legitimate use of Pester for writing tests for Powershell scripts and modules

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.