Windows: Code execution via Pester.bat invoked by PowerShell (Invoke-Pester/Get-Help)

Alerts when PowerShell spawns Pester.bat with parent command lines referencing Pester invocation or help usage.

FreeReviewedSigma · Medium · v2

Product: windows
Category: process_creation
Author: frack113, Nasreddine Bencherchali (SigmaHQ), DRL 1.1
Published: 2022-08-20
Updated: 2026-07-31

ATT&CK techniques

Execution → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
- T1059.001PowerShell
Persistence
Priv Esc
Defense Evasion
- T1216System Script Proxy Execution
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

Identifies process execution where the parent is Windows PowerShell (powershell.exe/pwsh.exe) and the parent command line references the Pester module path. It further matches parent commands that include common Pester usage patterns such as invoking Pester with exit enabled or calling Get-Help. This matters because attackers can leverage legitimate testing tooling to run PowerShell-driven code and blend into normal module activity. The rule relies on process creation telemetry capturing parent image and parent command line content.

Reporting behind it

Related detections9 linkedT1059.001 — drag to rearrange

Suspicious PowerShell Execution via SyncAppvPublishingServer LOLBIN

Malicious Command Injection via SyncAppvPublishingServer VBS LOLBin (via process_creation)

Windows: Code Execution via Pester.bat Using PowerShell Help or cmd.exe

Suspicious IIS Worker Process Spawning Command or Scripting Interpreter via SharePoint ToolShell Exploitation (via process_creation)

Suspicious PowerShell Download Cradle Spawned from Explorer via ClickFix Lure (via process_creation)

Malicious Interlock RAT FileFix Download-Cradle via PowerShell WebClient with PowerShell User-Agent (via ps_script)

Malicious Metasploit Stager Delivery via mshta Remote HTA (via process_creation)

Suspicious PowerShell Download of Disguised Payload to ProgramData

Suspicious PowerShell WebClient Download of Executable Payload

Windows: Code execution via Pester.bat invoked by PowerShell (Invoke-Pester/Get-Help)

Pivot detection · T1059.001 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-code-execution-via-pester-bat-spawned-by-powershell-18988e1b

title: "Windows: Code execution via Pester.bat invoked by PowerShell (Invoke-Pester/Get-Help)"
id: ac81ad1e-e3a7-47f9-8a4e-5f5550bacdb9
related:
  - id: 59e938ff-0d6d-4dc3-b13f-36cc28734d4e
    type: similar
  - id: 18988e1b-9087-4f8a-82fe-0414dce49878
    type: derived
status: test
description: Identifies process execution where the parent is Windows PowerShell (powershell.exe/pwsh.exe) and the parent command line references the Pester module path. It further matches parent commands that include common Pester usage patterns such as invoking Pester with exit enabled or calling Get-Help. This matters because attackers can leverage legitimate testing tooling to run PowerShell-driven code and blend into normal module activity. The rule relies on process creation telemetry capturing parent image and parent command line content.
references:
  - https://twitter.com/Oddvarmoe/status/993383596244258816
  - https://twitter.com/_st0pp3r_/status/1560072680887525378
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_lolbin_pester.yml
author: frack113, Nasreddine Bencherchali, Huntrule Team
date: 2022-08-20
tags:
  - attack.execution
  - attack.stealth
  - attack.t1059.001
  - attack.t1216
logsource:
  category: process_creation
  product: windows
detection:
  selection_module:
    ParentImage|endswith:
      - \powershell.exe
      - \pwsh.exe
    ParentCommandLine|contains: \WindowsPowerShell\Modules\Pester\
  selection_cli:
    ParentCommandLine|contains:
      - "{ Invoke-Pester -EnableExit ;"
      - '{ Get-Help "'
  condition: all of selection_*
falsepositives:
  - Legitimate use of Pester for writing tests for Powershell scripts and modules
level: medium
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL