Windows Process Execution: Suspicious AgentExecutor.exe PowerShell Launch with ExecutionPolicy Bypass

Detects AgentExecutor.exe command lines that trigger PowerShell script execution, including remediations and potentially bypassed ExecutionPolicy.

FreeReviewedSigma · High · v2

Product: windows
Category: process_creation
Author: Nasreddine Bencherchali (Nextron Systems), memory-shards (SigmaHQ), DRL 1.1
Published: 2022-12-24
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1218System Binary Proxy Execution
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule matches process creation events where AgentExecutor.exe is executed with command-line flags that trigger spawning PowerShell (including -powershell and -remediationScript). This matters because AgentExecutor.exe can be used as a proxy to run PowerShell under different execution-policy settings, potentially bypassing restrictions. It relies on Windows process creation telemetry fields for Image/OriginalFileName and CommandLine, and it filters out activity likely originating from standard PowerShell paths or Intune's management agent parent process.

Reporting behind it

Related detections9 linkedT1218 — drag to rearrange

Suspicious Cabinet Extraction of Masqueraded vstm Archive via extrac32

Malicious DLL Execution via Wuauclt Update Handler (via process_creation)

Malicious aspnet_compiler.exe Injection Host Spawned by PowerShell via process_creation

Malicious regsvcs LOLBin Loading Ransomware DLL from UNC Path

Suspicious RegAsm or RegSvcs Spawned by Script Host (via process_creation)

Suspicious Extexport DLL Side-Loading Execution

Malicious ClickFix Execution Chain Spawning MSHTA via Pcalua on EtherRAT Infection

Suspicious TALONITE Certutil LOLBIN Decode and Download Abuse (via process_creation)

Suspicious Renamed git Binary gcmd.exe Execution (via process_creation)

Windows Process Execution: Suspicious AgentExecutor.exe PowerShell Launch with ExecutionPolicy Bypass

Pivot detection · T1218 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-creation-agentexecutor-exe-powershell-launch-with-executionpolic-c0b40568

title: "Windows Process Execution: Suspicious AgentExecutor.exe PowerShell Launch with ExecutionPolicy Bypass"
id: 2e9abb5c-5af5-4f31-a74a-34535a8b5fbc
related:
  - id: 7efd2c8d-8b18-45b7-947d-adfe9ed04f61
    type: similar
  - id: c0b40568-b1e9-4b03-8d6c-b096da6da9ab
    type: derived
status: test
description: This rule matches process creation events where AgentExecutor.exe is executed with command-line flags that trigger spawning PowerShell (including -powershell and -remediationScript). This matters because AgentExecutor.exe can be used as a proxy to run PowerShell under different execution-policy settings, potentially bypassing restrictions. It relies on Windows process creation telemetry fields for Image/OriginalFileName and CommandLine, and it filters out activity likely originating from standard PowerShell paths or Intune's management agent parent process.
author: Nasreddine Bencherchali (Nextron Systems), memory-shards, Huntrule Team
references:
  - https://twitter.com/lefterispan/status/1286259016436514816
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Agentexecutor/
  - https://learn.microsoft.com/en-us/mem/intune/apps/intune-management-extension
  - https://twitter.com/jseerden/status/1247985304667066373/photo/1
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_agentexecutor_susp_usage.yml
date: 2022-12-24
modified: 2024-08-07
tags:
  - attack.stealth
  - attack.t1218
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \AgentExecutor.exe
    - OriginalFileName: AgentExecutor.exe
  selection_cli:
    CommandLine|contains:
      - " -powershell"
      - " -remediationScript"
  filter_main_pwsh:
    CommandLine|contains:
      - C:\Windows\System32\WindowsPowerShell\v1.0\
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\
  filter_main_intune:
    ParentImage|endswith: \Microsoft.Management.Services.IntuneWindowsAgent.exe
  condition: all of selection_* and not 1 of filter_main_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL