huntrule

Windows: Non-interactive PowerShell (powershell.exe/pwsh.exe) spawned from GUI or updater parents

Alerts on non-interactive PowerShell spawned by atypical parent processes, excluding known update, VS Code, terminal, and defender-related parents.

FreeReviewedSigma · Low · v1
Product
windows
Category
process_creation
Author
Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements) (SigmaHQ), DRL 1.1
Published
2019-09-12
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Execution

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags process creation where the executable ends with powershell.exe or pwsh.exe (including specific original file name variants) and the parent process is not one of the excluded update-related or optional development/defense tooling parents. It is useful because PowerShell launched from unexpected non-interactive parents can indicate automated execution patterns commonly used during attacker tradecraft. The detection relies on Windows process creation telemetry including Image and ParentImage (and, for some optional exclusions, ParentCommandLine).

Reporting behind it

Related detections9 linkedT1059.001 — drag to rearrange
Malicious Script Host Spawning PowerShell in Gootloader Chain
Suspicious PsExec Service Launching Encoded PowerShell Payload
Suspicious PowerShell Remote Script Execution via IEX DownloadString
Malicious SharePoint ToolShell Post-Exploitation via Encoded PowerShell (via process_creation)
Suspicious In-Memory PowerShell Execution from Web Server via Automation Assembly (via image_load)
Malicious Qilin Chrome Credential Harvesting Script Execution via IPScanner (via process_creation)
Suspicious Hidden PowerShell Spawned by Script Host via process_creation
Suspicious Run Key Persistence Referencing PowerShell Script via registry_set
Malicious FIN7 Powertrash Loader Execution via Obfuscated PowerShell (via process_creation)
Windows: Non-interactive PowerShell (powershell.exe/pwsh.exe) spawned from GUI or updater parents
Pivot detection · T1059.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.