Windows: Code execution via Pester.bat invoked by PowerShell (Invoke-Pester/Get-Help)

Alerts when PowerShell spawns Pester.bat with parent command lines referencing Pester invocation or help usage.

FreeReviewedSigma · Medium · v2

Product: windows
Category: process_creation
Author: frack113, Nasreddine Bencherchali (SigmaHQ), DRL 1.1
Published: 2022-08-20
Updated: 2026-07-31

ATT&CK techniques

Execution → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
- T1059.001PowerShell
Persistence
Priv Esc
Defense Evasion
- T1216System Script Proxy Execution
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

Identifies process execution where the parent is Windows PowerShell (powershell.exe/pwsh.exe) and the parent command line references the Pester module path. It further matches parent commands that include common Pester usage patterns such as invoking Pester with exit enabled or calling Get-Help. This matters because attackers can leverage legitimate testing tooling to run PowerShell-driven code and blend into normal module activity. The rule relies on process creation telemetry capturing parent image and parent command line content.

Reporting behind it

Related detections9 linkedT1059.001 — drag to rearrange

Suspicious PowerShell Execution via SyncAppvPublishingServer LOLBIN

Malicious Command Injection via SyncAppvPublishingServer VBS LOLBin (via process_creation)

Windows: Code Execution via Pester.bat Using PowerShell Help or cmd.exe

Suspicious PowerShell Spawned by cscript in Script Chain

Suspicious Script Interpreter Spawned by Explorer via ClickFix Run Dialog (via process_creation)

Suspicious PowerShell Download Cradle via ClickFix Fake CAPTCHA (via process_creation)

Suspicious PowerShell EncodedCommand Spawned From Command Shell via Process Creation

Suspicious Script Download via Curl and PowerShell by Dohdoor

Malicious Mass Hyper-V Virtual Machine Shutdown via PowerShell by Kraken Ransomware

Windows: Code execution via Pester.bat invoked by PowerShell (Invoke-Pester/Get-Help)

Pivot detection · T1059.001 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-code-execution-via-pester-bat-spawned-by-powershell-18988e1b

title: "Windows: Code execution via Pester.bat invoked by PowerShell (Invoke-Pester/Get-Help)"
id: ac81ad1e-e3a7-47f9-8a4e-5f5550bacdb9
related:
  - id: 59e938ff-0d6d-4dc3-b13f-36cc28734d4e
    type: similar
  - id: 18988e1b-9087-4f8a-82fe-0414dce49878
    type: derived
status: test
description: Identifies process execution where the parent is Windows PowerShell (powershell.exe/pwsh.exe) and the parent command line references the Pester module path. It further matches parent commands that include common Pester usage patterns such as invoking Pester with exit enabled or calling Get-Help. This matters because attackers can leverage legitimate testing tooling to run PowerShell-driven code and blend into normal module activity. The rule relies on process creation telemetry capturing parent image and parent command line content.
references:
  - https://twitter.com/Oddvarmoe/status/993383596244258816
  - https://twitter.com/_st0pp3r_/status/1560072680887525378
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_lolbin_pester.yml
author: frack113, Nasreddine Bencherchali, Huntrule Team
date: 2022-08-20
tags:
  - attack.execution
  - attack.stealth
  - attack.t1059.001
  - attack.t1216
logsource:
  category: process_creation
  product: windows
detection:
  selection_module:
    ParentImage|endswith:
      - \powershell.exe
      - \pwsh.exe
    ParentCommandLine|contains: \WindowsPowerShell\Modules\Pester\
  selection_cli:
    ParentCommandLine|contains:
      - "{ Invoke-Pester -EnableExit ;"
      - '{ Get-Help "'
  condition: all of selection_*
falsepositives:
  - Legitimate use of Pester for writing tests for Powershell scripts and modules
level: medium
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL