Windows PowerShell Process: Import-Module Execution in Command Line

Flags PowerShell command lines containing Import-Module, indicating module loading into the current session.

FreeUnreviewedSigmalowv1

windows-powershell-process-import-module-execution-in-command-line-4ad74d01

title: "Windows PowerShell Process: Import-Module Execution in Command Line"
id: 5cd7963a-f33d-4871-bdcc-29d66a596dd6
status: test
description: This rule flags Windows processes running PowerShell (powershell.exe or pwsh.exe) whose command line contains the Import-Module cmdlet. Attackers commonly use module import to load additional functionality into the current PowerShell session for persistence, discovery, or execution. The detection relies on process creation telemetry, specifically the executable image path and the command-line content.
references:
  - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/import-module?view=powershell-7.3
  - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/import-module?view=powershell-5.1
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_powershell_import_module.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-09
modified: 2023-12-01
tags:
  - attack.execution
  - detection.threat-hunting
logsource:
  product: windows
  category: process_creation
detection:
  selection_img:
    - Image|endswith:
        - \powershell.exe
        - \pwsh.exe
    - OriginalFileName:
        - PowerShell.EXE
        - pwsh.dll
  selection_cmdlet:
    CommandLine|contains:
      - "Import-Module "
      - "ipmo "
  filter_main_vsstudio:
    ParentImage|contains:
      - :\Program Files\WindowsApps\Microsoft.WindowsTerminal_
      - :\Windows\System32\cmd.exe
    CommandLine|contains|all:
      - :\Program Files\Microsoft Visual Studio\
      - Tools\Microsoft.VisualStudio.DevShell.dll
  condition: all of selection_* and not 1 of filter_main_*
falsepositives:
  - Depending on the environement, many legitimate scripts will import modules inline. This rule is targeted for hunting purposes.
level: low
license: DRL-1.1
related:
  - id: 4ad74d01-f48c-42d0-b88c-b31efa4d2262
    type: derived

What it detects

This rule flags Windows processes running PowerShell (powershell.exe or pwsh.exe) whose command line contains the Import-Module cmdlet. Attackers commonly use module import to load additional functionality into the current PowerShell session for persistence, discovery, or execution. The detection relies on process creation telemetry, specifically the executable image path and the command-line content.

Known false positives

Depending on the environement, many legitimate scripts will import modules inline. This rule is targeted for hunting purposes.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.