huntrule

PowerShell ScriptBlock launching redirected comspec to Alternate Data Stream via '>'

Flags PowerShell script blocks using Start-Process with comspec and " > " redirection consistent with ADS-style file hiding.

FreeReviewedSigma · Medium · v2
Product
windows
Category
ps_script
Author
frack113 (SigmaHQ), DRL 1.1
Published
2021-09-02
Updated
2026-07-31
AnalysisDetection
title: PowerShell ScriptBlock launching redirected comspec to Alternate Data Stream via '>'
id: b2a761f6-714d-4f72-b196-1c3197efd5e2
status: test
description: This rule identifies PowerShell script content that starts a new process with Start-Process, targeting $env:comspec and redirecting output using the '>' operator with -ArgumentList. Redirecting output to a path using Alternate Data Streams can help attackers hide or stage payloads within a legitimate file. It relies on PowerShell Script Block text logging to observe the specific command construction and redirection pattern.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.004/T1564.004.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_store_file_in_alternate_data_stream.yml
author: frack113, Huntrule Team
date: 2021-09-02
modified: 2022-12-25
tags:
  - attack.stealth
  - attack.t1564.004
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection_compspec:
    ScriptBlockText|contains|all:
      - Start-Process
      - '-FilePath "$env:comspec" '
      - "-ArgumentList "
      - ">"
  condition: selection_compspec
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: a699b30e-d010-46c8-bbd1-ee2e26765fe9
    type: derived