Windows PowerShell script launcher matching SysAidServer Tomcat paths

Flags PowerShell script block text tied to SysAid Tomcat webapp paths and user.exe staging/launch actions.

FreeReviewedSigma · High · v5

Product: windows
Category: ps_script
Author: Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2023-11-09
Updated: 2026-07-31

ATT&CK techniques

Execution

Recon
Resource Dev
Initial Access
Execution
- T1059.001PowerShell
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule matches PowerShell script block text that references a SysAidServer Tomcat webapps path and includes commands related to launching a user.exe payload, removing a downloaded file, and invoking the (Sophos) component. Such scripting patterns are used by attackers to stage and execute malware through PowerShell, making the observed script content a useful indicator for suspicious execution. It relies on Windows PowerShell Script Block Logging telemetry to capture and inspect script block text.

Reporting behind it

Related detections9 linkedT1059.001 — drag to rearrange

Suspicious PowerShell Spawned by cscript in Script Chain

Suspicious Script Interpreter Spawned by Explorer via ClickFix Run Dialog (via process_creation)

Suspicious PowerShell Download Cradle via ClickFix Fake CAPTCHA (via process_creation)

Suspicious PowerShell EncodedCommand Spawned From Command Shell via Process Creation

Suspicious Script Download via Curl and PowerShell by Dohdoor

Malicious Mass Hyper-V Virtual Machine Shutdown via PowerShell by Kraken Ransomware

Suspicious PowerShell WebClient DownloadFile of Archive Payload (UAT-7237)

Suspicious SharePoint Worker Process Spawning Command Interpreter via ToolShell

Malicious Emmenhtal JavaScript Loader Spawning Encoded PowerShell

Windows PowerShell script launcher matching SysAidServer Tomcat paths

Pivot detection · T1059.001 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-powershell-launcher-script-referencing-sysaid-tomcat-paths-and-user-exe--37dc5463

title: Windows PowerShell script launcher matching SysAidServer Tomcat paths
id: cc5c4e5e-1e9a-4bd0-ba14-b6130292d4f3
status: test
description: This rule matches PowerShell script block text that references a SysAidServer Tomcat webapps path and includes commands related to launching a user.exe payload, removing a downloaded file, and invoking the (Sophos) component. Such scripting patterns are used by attackers to stage and execute malware through PowerShell, making the observed script content a useful indicator for suspicious execution. It relies on Windows PowerShell Script Block Logging telemetry to capture and inspect script block text.
references:
  - https://www.sysaid.com/blog/service-desk/on-premise-software-security-vulnerability-notification
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/Lace-Tempest/posh_ps_apt_lace_tempest_malware_launcher.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-11-09
tags:
  - attack.execution
  - attack.t1059.001
  - detection.emerging-threats
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains|all:
      - \SysAidServer\tomcat\webapps
      - Starting user.exe
      - \usersfiles\user.exe
      - Remove-Item -Force "$wapps
      - (Sophos).
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 37dc5463-f7e3-4f61-ad76-ba59cd02a651
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL