huntrule

Windows PowerShell Launch Triggered via Executable Version Mismatch

Detects PowerShell execution attempts that match a specific executable EngineVersion/HostVersion mismatch pattern on Windows.

FreeUnreviewedSigmahighv1
title: Windows PowerShell Launch Triggered via Executable Version Mismatch
id: 8281ebd2-2751-4800-bb2f-ef579204ea2a
status: test
description: This rule flags cases where PowerShell is launched using a version-mismatch pattern, indicated by specific EngineVersion values in the recorded data alongside a HostVersion value. Attackers may use this behavior to execute PowerShell while blending into expected invocation flows or evading simplistic execution checks. The detection relies on process start telemetry from classic PowerShell (ps_classic_start) containing the relevant EngineVersion and HostVersion substrings.
references:
  - https://adsecurity.org/?p=2921
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_classic/posh_pc_exe_calling_ps.yml
author: Sean Metcalf (source), Florian Roth (Nextron Systems), Huntrule Team
date: 2017-03-05
modified: 2023-10-27
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  product: windows
  category: ps_classic_start
detection:
  selection_engine:
    Data|contains:
      - EngineVersion=2.
      - EngineVersion=4.
      - EngineVersion=5.
  selection_host:
    Data|contains: HostVersion=3.
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: c70e019b-1479-4b65-b0cc-cd0c6093a599
    type: derived

What it detects

This rule flags cases where PowerShell is launched using a version-mismatch pattern, indicated by specific EngineVersion values in the recorded data alongside a HostVersion value. Attackers may use this behavior to execute PowerShell while blending into expected invocation flows or evading simplistic execution checks. The detection relies on process start telemetry from classic PowerShell (ps_classic_start) containing the relevant EngineVersion and HostVersion substrings.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.