huntrule

Windows Process Creation: AgentExecutor.exe PowerShell Launch with ExecutionPolicy Bypass

Detects AgentExecutor.exe command lines that trigger PowerShell script execution, including remediations and potentially bypassed ExecutionPolicy.

FreeUnreviewedSigmahighv1
title: "Windows Process Creation: AgentExecutor.exe PowerShell Launch with ExecutionPolicy Bypass"
id: 2e9abb5c-5af5-4f31-a74a-34535a8b5fbc
related:
  - id: 7efd2c8d-8b18-45b7-947d-adfe9ed04f61
    type: similar
  - id: c0b40568-b1e9-4b03-8d6c-b096da6da9ab
    type: derived
status: test
description: This rule flags process executions of AgentExecutor.exe where the command line includes AgentExecutor’s PowerShell execution flags (e.g., "-powershell" and "-remediationScript"). This behavior matters because AgentExecutor can be leveraged to spawn PowerShell to run scripts, including cases aligned with a permissive ExecutionPolicy via its invocation arguments. The detection relies on Windows process creation telemetry, matching the executable by name and correlating with specific command-line substrings, while excluding cases where the spawned PowerShell path belongs to standard Windows PowerShell locations or where the parent process is the Intune agent.
author: Nasreddine Bencherchali (Nextron Systems), memory-shards, Huntrule Team
references:
  - https://twitter.com/lefterispan/status/1286259016436514816
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Agentexecutor/
  - https://learn.microsoft.com/en-us/mem/intune/apps/intune-management-extension
  - https://twitter.com/jseerden/status/1247985304667066373/photo/1
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_agentexecutor_susp_usage.yml
date: 2022-12-24
modified: 2024-08-07
tags:
  - attack.stealth
  - attack.t1218
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \AgentExecutor.exe
    - OriginalFileName: AgentExecutor.exe
  selection_cli:
    CommandLine|contains:
      - " -powershell"
      - " -remediationScript"
  filter_main_pwsh:
    CommandLine|contains:
      - C:\Windows\System32\WindowsPowerShell\v1.0\
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\
  filter_main_intune:
    ParentImage|endswith: \Microsoft.Management.Services.IntuneWindowsAgent.exe
  condition: all of selection_* and not 1 of filter_main_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1

What it detects

This rule flags process executions of AgentExecutor.exe where the command line includes AgentExecutor’s PowerShell execution flags (e.g., "-powershell" and "-remediationScript"). This behavior matters because AgentExecutor can be leveraged to spawn PowerShell to run scripts, including cases aligned with a permissive ExecutionPolicy via its invocation arguments. The detection relies on Windows process creation telemetry, matching the executable by name and correlating with specific command-line substrings, while excluding cases where the spawned PowerShell path belongs to standard Windows PowerShell locations or where the parent process is the Intune agent.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.