Windows PowerShell: Execution of TroubleshootingPack cmdlet for unattended troubleshooting

Flags PowerShell script blocks invoking TroubleshootingPack with unattended answer-file arguments.

FreeUnreviewedSigmamediumv1

windows-powershell-execution-of-troubleshootingpack-cmdlet-for-unattended-troubl-03409c93

title: "Windows PowerShell: Execution of TroubleshootingPack cmdlet for unattended troubleshooting"
id: 8db0dbc1-1644-4277-9397-ca95f451c81e
status: test
description: This rule identifies PowerShell script block execution that runs the TroubleshootingPack cmdlet with arguments indicating an automated, unattended workflow. Attackers may use this behavior to trigger system troubleshooting components outside normal user interaction as part of exploitation or post-exploitation staging. Telemetry relies on PowerShell script block text containing the cmdlet invocation, the specific PCW diagnostics path, and the -AnswerFile and -Unattended parameters.
references:
  - https://twitter.com/nas_bench/status/1537919885031772161
  - https://lolbas-project.github.io/lolbas/Binaries/Msdt/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_follina_execution.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-06-21
tags:
  - attack.stealth
  - attack.t1202
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains|all:
      - Invoke-TroubleshootingPack
      - C:\Windows\Diagnostics\System\PCW
      - -AnswerFile
      - -Unattended
  condition: selection
falsepositives:
  - Legitimate usage of "TroubleshootingPack" cmdlet for troubleshooting purposes
level: medium
license: DRL-1.1
related:
  - id: 03409c93-a7c7-49ba-9a4c-a00badf2a153
    type: derived

What it detects

This rule identifies PowerShell script block execution that runs the TroubleshootingPack cmdlet with arguments indicating an automated, unattended workflow. Attackers may use this behavior to trigger system troubleshooting components outside normal user interaction as part of exploitation or post-exploitation staging. Telemetry relies on PowerShell script block text containing the cmdlet invocation, the specific PCW diagnostics path, and the -AnswerFile and -Unattended parameters.

Known false positives

Legitimate usage of "TroubleshootingPack" cmdlet for troubleshooting purposes

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.