Windows: Code Execution via Pester.bat Using PowerShell or cmd

title: "Windows: Code Execution via Pester.bat Using PowerShell or cmd"
id: cb5987e2-f072-4f5b-b017-fa98ef97828f
status: test
description: This rule identifies execution behavior consistent with using Pester tooling (Pester.bat) to run PowerShell commands or invoke help-style arguments. Attackers may leverage Pester to execute or script actions while blending into legitimate PowerShell/module activity. Telemetry relies on Windows process creation events, matching process image paths (powershell.exe/pwsh.exe and cmd.exe) and command-line content related to Pester and Get-Help/help and help switches.
references:
  - https://twitter.com/Oddvarmoe/status/993383596244258816
  - https://github.com/api0cradle/LOLBAS/blob/d148d278f5f205ce67cfaf49afdfb68071c7252a/OSScripts/pester.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_lolbin_pester_1.yml
author: Julia Fomina, oscd.community, Huntrule Team
date: 2020-10-08
modified: 2023-11-09
tags:
  - attack.execution
  - attack.stealth
  - attack.t1059.001
  - attack.t1216
logsource:
  category: process_creation
  product: windows
detection:
  powershell_module:
    Image|endswith:
      - \powershell.exe
      - \pwsh.exe
    CommandLine|contains|all:
      - Pester
      - Get-Help
  cmd_execution:
    Image|endswith: \cmd.exe
    CommandLine|contains|all:
      - pester
      - ;
  get_help:
    CommandLine|contains:
      - help
      - \?
  condition: powershell_module or (cmd_execution and get_help)
falsepositives:
  - Legitimate use of Pester for writing tests for Powershell scripts and modules
level: medium
license: DRL-1.1
related:
  - id: 59e938ff-0d6d-4dc3-b13f-36cc28734d4e
    type: derived