Windows PowerShell: Uncommon HostApplication Values in PS Classic Start Telemetry

Detects PowerShell classic start events with unusual HostApplication values that may indicate evasion of powershell.exe-focused detections.

FreeUnreviewedSigmamediumv1

windows-powershell-uncommon-hostapplication-values-in-ps-classic-start-telemetry-d7326048

title: "Windows PowerShell: Uncommon HostApplication Values in PS Classic Start Telemetry"
id: 9343952f-0fe0-41ef-9758-a2eeab07aee8
related:
  - id: 64e8e417-c19a-475a-8d19-98ea705394cc
    type: derived
  - id: d7326048-328b-4d5e-98af-86e84b17c765
    type: derived
status: test
description: This rule flags PowerShell classic start events where the HostApplication field is present but does not match common PowerShell interpreter or known benign host paths. Attackers may use alternate PowerShell host invocation patterns to evade detections that specifically watch for powershell.exe. The detection relies on Windows PowerShell start telemetry fields where Data contains HostApplication= entries, with exclusions for several known PowerShell and related script/agent hosts.
references:
  - https://threathunterplaybook.com/hunts/windows/190815-RemoteServiceInstallation/notebook.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/powershell/powershell_classic/posh_pc_alternate_powershell_hosts.yml
author: Roberto Rodriguez @Cyb3rWard0g, Huntrule Team
date: 2019-08-11
modified: 2025-10-22
tags:
  - attack.execution
  - attack.t1059.001
  - detection.threat-hunting
logsource:
  product: windows
  category: ps_classic_start
detection:
  selection:
    Data|contains: HostApplication=
  filter_main_ps:
    Data|contains:
      - HostApplication=?:/Windows/System32/WindowsPowerShell/v1.0/powershell
      - HostApplication=?:/Windows/SysWOW64/WindowsPowerShell/v1.0/powershell
      - HostApplication=?:\Windows\System32\sdiagnhost.exe
      - HostApplication=?:\Windows\System32\WindowsPowerShell\v1.0\powershell
      - HostApplication=?:\Windows\SysWOW64\sdiagnhost.exe
      - HostApplication=?:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell
      - HostApplication=powershell
  filter_optional_citrix:
    Data|contains: Citrix\ConfigSync\ConfigSync.ps1
  filter_optional_hexnode:
    Data|contains: HostApplication=C:\Hexnode\Hexnode Agent\Current\HexnodeAgent.exe
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Programs using PowerShell directly without invocation of a dedicated interpreter
  - MSP Detection Searcher
  - Citrix ConfigSync.ps1
level: medium
license: DRL-1.1

What it detects

This rule flags PowerShell classic start events where the HostApplication field is present but does not match common PowerShell interpreter or known benign host paths. Attackers may use alternate PowerShell host invocation patterns to evade detections that specifically watch for powershell.exe. The detection relies on Windows PowerShell start telemetry fields where Data contains HostApplication= entries, with exclusions for several known PowerShell and related script/agent hosts.

Known false positives

Programs using PowerShell directly without invocation of a dedicated interpreter
MSP Detection Searcher
Citrix ConfigSync.ps1

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.