Windows Process Execution of AgentExecutor.exe with PowerShell Bypass

Alerts on AgentExecutor.exe launches that pass -powershell/-remediationScript to run PowerShell (including bypass execution policy).

FreeUnreviewedSigmamediumv1

windows-process-execution-of-agentexecutor-exe-with-powershell-bypass-7efd2c8d

title: Windows Process Execution of AgentExecutor.exe with PowerShell Bypass
id: 3aef1b3c-e462-41ae-8739-986c40ed38cc
related:
  - id: c0b40568-b1e9-4b03-8d6c-b096da6da9ab
    type: similar
  - id: 7efd2c8d-8b18-45b7-947d-adfe9ed04f61
    type: derived
status: test
description: This rule flags process creation where AgentExecutor.exe is executed with command-line arguments indicating PowerShell script execution (including the -powershell flag or -remediationScript). The behavior matters because AgentExecutor.exe can invoke PowerShell while using ExecutionPolicy set to bypass, enabling stealthy script execution via a trusted binary. It relies on Windows process creation telemetry, matching Image/OriginalFileName and specific command-line substrings indicating PowerShell invocation.
author: Nasreddine Bencherchali (Nextron Systems), memory-shards, Huntrule Team
references:
  - https://twitter.com/lefterispan/status/1286259016436514816
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Agentexecutor/
  - https://learn.microsoft.com/en-us/mem/intune/apps/intune-management-extension
  - https://twitter.com/jseerden/status/1247985304667066373/photo/1
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_agentexecutor_potential_abuse.yml
date: 2022-12-24
modified: 2024-08-07
tags:
  - attack.stealth
  - attack.t1218
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image: \AgentExecutor.exe
    - OriginalFileName: AgentExecutor.exe
  selection_cli:
    CommandLine|contains:
      - " -powershell"
      - " -remediationScript"
  filter_main_intune:
    ParentImage|endswith: \Microsoft.Management.Services.IntuneWindowsAgent.exe
  condition: all of selection_* and not 1 of filter_main_*
falsepositives:
  - Legitimate use via Intune management. You exclude script paths and names to reduce FP rate
level: medium
license: DRL-1.1

What it detects

This rule flags process creation where AgentExecutor.exe is executed with command-line arguments indicating PowerShell script execution (including the -powershell flag or -remediationScript). The behavior matters because AgentExecutor.exe can invoke PowerShell while using ExecutionPolicy set to bypass, enabling stealthy script execution via a trusted binary. It relies on Windows process creation telemetry, matching Image/OriginalFileName and specific command-line substrings indicating PowerShell invocation.

Known false positives

Legitimate use via Intune management. You exclude script paths and names to reduce FP rate

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.