Windows Process Creation: Detect Covenant PowerShell Launcher Command Lines
Identifies Windows PowerShell command lines commonly used by Covenant launchers, including hidden/encoded execution patterns.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community (SigmaHQ), DRL 1.1
- Published
- 2020-06-04
- Updated
- 2026-07-31
ATT&CK techniques
Execution → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows process creation events with PowerShell command-line arguments commonly seen in Covenant launchers, including flags such as -Sta, -Nop, and Hidden windowing. It also matches specific chained behaviors like using -Command/-EncodedCommand along with patterns that reference IO.MemoryStream staging and mshta file.hta fetching with encoded payload fragments. The detection relies on detailed process command-line telemetry to identify suspicious execution characteristics rather than the executable name alone.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: Detect Covenant PowerShell Launcher Command Lines"
id: c78aa908-e729-4839-9ff0-f7355f0054f8
status: test
description: This rule flags Windows process creation events with PowerShell command-line arguments commonly seen in Covenant launchers, including flags such as -Sta, -Nop, and Hidden windowing. It also matches specific chained behaviors like using -Command/-EncodedCommand along with patterns that reference IO.MemoryStream staging and mshta file.hta fetching with encoded payload fragments. The detection relies on detailed process command-line telemetry to identify suspicious execution characteristics rather than the executable name alone.
references:
- https://posts.specterops.io/covenant-v0-5-eee0507b85ba
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_covenant.yml
author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Huntrule Team
date: 2020-06-04
modified: 2023-02-21
tags:
- attack.execution
- attack.stealth
- attack.t1059.001
- attack.t1564.003
logsource:
category: process_creation
product: windows
detection:
selection_1:
CommandLine|contains|all:
- -Sta
- -Nop
- -Window
- Hidden
CommandLine|contains:
- -Command
- -EncodedCommand
selection_2:
CommandLine|contains:
- "sv o (New-Object IO.MemorySteam);sv d "
- mshta file.hta
- GruntHTTP
- -EncodedCommand cwB2ACAAbwAgA
condition: 1 of selection_*
level: high
license: DRL-1.1
related:
- id: c260b6db-48ba-4b4a-a76f-2f67644e99d2
type: derived