Windows PowerShell Script Block Logs: Get-Process Process Discovery

Alerts when PowerShell script blocks contain Get-Process, indicating local process discovery activity.

FreeUnreviewedSigmalowv1

windows-powershell-script-block-logs-get-process-process-discovery-af4c87ce

title: "Windows PowerShell Script Block Logs: Get-Process Process Discovery"
id: 1a0087cc-3262-45ed-8412-96c7ecd6b92d
status: test
description: This rule flags PowerShell script block content that includes the Get-Process cmdlet, which is commonly used to enumerate running processes on the local host. Process discovery helps attackers gather context for subsequent actions such as targeting specific processes or identifying security tools. It relies on Script Block Logging telemetry to capture the presence of Get-Process within executed PowerShell script content.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1057/T1057.md#atomic-test-3---process-discovery---get-process
  - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-process?view=powershell-7.4
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_get_process.yml
author: frack113, Huntrule Team
date: 2022-03-17
tags:
  - attack.discovery
  - attack.t1057
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains: Get-Process
  condition: selection
falsepositives:
  - Legitimate PowerShell scripts
level: low
license: DRL-1.1
related:
  - id: af4c87ce-bdda-4215-b998-15220772e993
    type: derived

What it detects

This rule flags PowerShell script block content that includes the Get-Process cmdlet, which is commonly used to enumerate running processes on the local host. Process discovery helps attackers gather context for subsequent actions such as targeting specific processes or identifying security tools. It relies on Script Block Logging telemetry to capture the presence of Get-Process within executed PowerShell script content.

Known false positives

Legitimate PowerShell scripts

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.