Windows Process Creation: Detect Covenant PowerShell Launcher Command Lines

Identifies Windows PowerShell command lines commonly used by Covenant launchers, including hidden/encoded execution patterns.

FreeReviewedSigma · High · v2

Product: windows
Category: process_creation
Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community (SigmaHQ), DRL 1.1
Published: 2020-06-04
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Execution → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
- T1059.001PowerShell
Persistence
Priv Esc
Defense Evasion
- T1564.003Hidden Window
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows process creation events with PowerShell command-line arguments commonly seen in Covenant launchers, including flags such as -Sta, -Nop, and Hidden windowing. It also matches specific chained behaviors like using -Command/-EncodedCommand along with patterns that reference IO.MemoryStream staging and mshta file.hta fetching with encoded payload fragments. The detection relies on detailed process command-line telemetry to identify suspicious execution characteristics rather than the executable name alone.

Reporting behind it

Related detections9 linkedT1059.001 — drag to rearrange

Suspicious Script Host Spawning Hidden PowerShell (via process_creation)

PowerShell Launch With --headless From Conhost.exe on Windows

Suspicious PowerShell Reflective Assembly Load With GZip Decompression (via process_creation)

Suspicious PowerShell Invoke-Expression with Replace Obfuscation

Suspicious PowerShell Archive Extraction to AppData Roaming

Malicious PowerShell Spawned by Masqueraded NVIDIA GeForce Experience Binary

Suspicious PowerShell Hidden Unrestricted Execution via ClickFix

Suspicious PowerShell Spawned by cscript in Script Chain

Suspicious Script Interpreter Spawned by Explorer via ClickFix Run Dialog (via process_creation)

Windows Process Creation: Detect Covenant PowerShell Launcher Command Lines

Pivot detection · T1059.001 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-powershell-command-line-indicators-for-covenant-hacktool-launcher-usage-c260b6db

title: "Windows Process Creation: Detect Covenant PowerShell Launcher Command Lines"
id: c78aa908-e729-4839-9ff0-f7355f0054f8
status: test
description: This rule flags Windows process creation events with PowerShell command-line arguments commonly seen in Covenant launchers, including flags such as -Sta, -Nop, and Hidden windowing. It also matches specific chained behaviors like using -Command/-EncodedCommand along with patterns that reference IO.MemoryStream staging and mshta file.hta fetching with encoded payload fragments. The detection relies on detailed process command-line telemetry to identify suspicious execution characteristics rather than the executable name alone.
references:
  - https://posts.specterops.io/covenant-v0-5-eee0507b85ba
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_covenant.yml
author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Huntrule Team
date: 2020-06-04
modified: 2023-02-21
tags:
  - attack.execution
  - attack.stealth
  - attack.t1059.001
  - attack.t1564.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_1:
    CommandLine|contains|all:
      - -Sta
      - -Nop
      - -Window
      - Hidden
    CommandLine|contains:
      - -Command
      - -EncodedCommand
  selection_2:
    CommandLine|contains:
      - "sv o (New-Object IO.MemorySteam);sv d "
      - mshta file.hta
      - GruntHTTP
      - -EncodedCommand cwB2ACAAbwAgA
  condition: 1 of selection_*
level: high
license: DRL-1.1
related:
  - id: c260b6db-48ba-4b4a-a76f-2f67644e99d2
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL