Windows Process Creation: Jlaive In-Memory Assembly Execution via PowerShell and Hidden Copied .bat.exe

title: "Windows Process Creation: Jlaive In-Memory Assembly Execution via PowerShell and Hidden Copied .bat.exe"
id: 32495855-d083-4aef-a213-357f99736f2f
status: test
description: This rule flags Windows process creation events where cmd.exe launches a .bat file that uses xcopy to copy and invoke PowerShell or pwsh with a .bat.exe payload. It also correlates use of attrib.exe to set hidden and system file attributes (+h and +s) on the same .bat.exe. This behavior matters because it chains script-driven staging with hidden execution, consistent with in-memory or evasive assembly execution workflows. Telemetry relies on process creation fields such as ParentImage, ParentCommandLine, Image, and CommandLine, including command-line substrings like powershell.exe/pwsh.exe, .bat.exe, and attrib +h/+s.
references:
  - https://jstnk9.github.io/jstnk9/research/Jlaive-Antivirus-Evasion-Tool
  - https://web.archive.org/web/20220514073704/https://github.com/ch2sh/Jlaive
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_jlaive_batch_execution.yml
author: Jose Luis Sanchez Martinez (@Joseliyo_Jstnk), Huntrule Team
date: 2022-05-24
modified: 2023-02-22
tags:
  - attack.execution
  - attack.t1059.003
logsource:
  product: windows
  category: process_creation
detection:
  parent_selection:
    ParentImage|endswith: \cmd.exe
    ParentCommandLine|endswith: .bat
  selection1:
    Image|endswith: \xcopy.exe
    CommandLine|contains|all:
      - powershell.exe
      - .bat.exe
  selection2:
    Image|endswith: \xcopy.exe
    CommandLine|contains|all:
      - pwsh.exe
      - .bat.exe
  selection3:
    Image|endswith: \attrib.exe
    CommandLine|contains|all:
      - +s
      - +h
      - .bat.exe
  condition: parent_selection and (1 of selection*)
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 0a99eb3e-1617-41bd-b095-13dc767f3def
    type: derived