Windows PowerShell command-line indicators for Covenant HackTool launcher usage

Identifies Windows PowerShell command lines commonly used by Covenant launchers, including hidden/encoded execution patterns.

FreeUnreviewedSigmahighv1

windows-powershell-command-line-indicators-for-covenant-hacktool-launcher-usage-c260b6db

title: Windows PowerShell command-line indicators for Covenant HackTool launcher usage
id: c78aa908-e729-4839-9ff0-f7355f0054f8
status: test
description: This rule flags suspicious Windows process creation command lines consistent with a Covenant launcher using PowerShell. Attackers may use PowerShell with hidden window and encoded command execution to launch malicious stages while reducing user visibility. The detection relies on process creation telemetry and matches specific command-line substrings such as PowerShell flags, encoded command usage, and launcher-related script components.
references:
  - https://posts.specterops.io/covenant-v0-5-eee0507b85ba
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_covenant.yml
author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Huntrule Team
date: 2020-06-04
modified: 2023-02-21
tags:
  - attack.execution
  - attack.stealth
  - attack.t1059.001
  - attack.t1564.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_1:
    CommandLine|contains|all:
      - -Sta
      - -Nop
      - -Window
      - Hidden
    CommandLine|contains:
      - -Command
      - -EncodedCommand
  selection_2:
    CommandLine|contains:
      - "sv o (New-Object IO.MemorySteam);sv d "
      - mshta file.hta
      - GruntHTTP
      - -EncodedCommand cwB2ACAAbwAgA
  condition: 1 of selection_*
level: high
license: DRL-1.1
related:
  - id: c260b6db-48ba-4b4a-a76f-2f67644e99d2
    type: derived

What it detects

This rule flags suspicious Windows process creation command lines consistent with a Covenant launcher using PowerShell. Attackers may use PowerShell with hidden window and encoded command execution to launch malicious stages while reducing user visibility. The detection relies on process creation telemetry and matches specific command-line substrings such as PowerShell flags, encoded command usage, and launcher-related script components.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.