huntrule

Windows PowerShell script launcher matching SysAidServer Tomcat paths

Flags PowerShell script block text tied to SysAid Tomcat webapp paths and user.exe staging/launch actions.

FreeReviewedSigma · High · v5
Product
windows
Category
ps_script
Author
Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2023-11-09
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Execution

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule matches PowerShell script block text that references a SysAidServer Tomcat webapps path and includes commands related to launching a user.exe payload, removing a downloaded file, and invoking the (Sophos) component. Such scripting patterns are used by attackers to stage and execute malware through PowerShell, making the observed script content a useful indicator for suspicious execution. It relies on Windows PowerShell Script Block Logging telemetry to capture and inspect script block text.

Reporting behind it

Related detections9 linkedT1059.001 — drag to rearrange
Suspicious PowerShell Spawned by cscript in Script Chain
Suspicious Script Interpreter Spawned by Explorer via ClickFix Run Dialog (via process_creation)
Suspicious PowerShell Download Cradle via ClickFix Fake CAPTCHA (via process_creation)
Suspicious PowerShell EncodedCommand Spawned From Command Shell via Process Creation
Suspicious Script Download via Curl and PowerShell by Dohdoor
Malicious Mass Hyper-V Virtual Machine Shutdown via PowerShell by Kraken Ransomware
Suspicious PowerShell WebClient DownloadFile of Archive Payload (UAT-7237)
Suspicious SharePoint Worker Process Spawning Command Interpreter via ToolShell
Malicious Emmenhtal JavaScript Loader Spawning Encoded PowerShell
Windows PowerShell script launcher matching SysAidServer Tomcat paths
Pivot detection · T1059.001 · 9 related

Changelog

v5
  1. v5
    Candidate ingested via manual entry.2026-07-31
  2. v4
    Candidate ingested via manual entry.2026-07-31
  3. v3
    Candidate ingested via manual entry.2026-07-31
  4. v2
    Candidate ingested via manual entry.2026-07-31
  5. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.