Windows: Code Execution via Pester.bat Using PowerShell Help or cmd.exe
Flags Windows process executions that invoke Pester-related help/commands via PowerShell or cmd, consistent with Pester.bat usage.
- Product
- windows
- Category
- process_creation
- Author
- Julia Fomina, oscd.community (SigmaHQ), DRL 1.1
- Published
- 2020-10-08
- Updated
- 2026-07-31
ATT&CK techniques
Execution → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies suspicious use of Pester-related execution patterns that can lead to code execution. It matches PowerShell invocations containing both "Pester" and "Get-Help", as well as cmd.exe command lines containing "pester" plus a semicolon and help-query indicators ("help" and "\?"), which may reflect attacker-controlled execution through Pester.bat-style behavior. The detection relies on process creation telemetry with process image paths and command-line arguments.
Reporting behind it
- twitter.comhttps://twitter.com/Oddvarmoe/status/993383596244258816
- github.comhttps://github.com/api0cradle/LOLBAS/blob/d148d278f5f205ce67cfaf49afdfb68071c7252a/OSScripts/pester.md
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_lolbin_pester_1.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: Code Execution via Pester.bat Using PowerShell Help or cmd.exe"
id: cb5987e2-f072-4f5b-b017-fa98ef97828f
status: test
description: This rule identifies suspicious use of Pester-related execution patterns that can lead to code execution. It matches PowerShell invocations containing both "Pester" and "Get-Help", as well as cmd.exe command lines containing "pester" plus a semicolon and help-query indicators ("help" and "\?"), which may reflect attacker-controlled execution through Pester.bat-style behavior. The detection relies on process creation telemetry with process image paths and command-line arguments.
references:
- https://twitter.com/Oddvarmoe/status/993383596244258816
- https://github.com/api0cradle/LOLBAS/blob/d148d278f5f205ce67cfaf49afdfb68071c7252a/OSScripts/pester.md
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_lolbin_pester_1.yml
author: Julia Fomina, oscd.community, Huntrule Team
date: 2020-10-08
modified: 2023-11-09
tags:
- attack.execution
- attack.stealth
- attack.t1059.001
- attack.t1216
logsource:
category: process_creation
product: windows
detection:
powershell_module:
Image|endswith:
- \powershell.exe
- \pwsh.exe
CommandLine|contains|all:
- Pester
- Get-Help
cmd_execution:
Image|endswith: \cmd.exe
CommandLine|contains|all:
- pester
- ;
get_help:
CommandLine|contains:
- help
- \?
condition: powershell_module or (cmd_execution and get_help)
falsepositives:
- Legitimate use of Pester for writing tests for Powershell scripts and modules
level: medium
license: DRL-1.1
related:
- id: 59e938ff-0d6d-4dc3-b13f-36cc28734d4e
type: derived