Windows AgentExecutor.exe PowerShell Execution (ExecutionPolicy Bypass) Process Creation

Alerts on AgentExecutor.exe launches that pass -powershell/-remediationScript to run PowerShell (including bypass execution policy).

FreeReviewedSigma · Medium · v2

Product: windows
Category: process_creation
Author: Nasreddine Bencherchali (Nextron Systems), memory-shards (SigmaHQ), DRL 1.1
Published: 2022-12-24
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1218System Binary Proxy Execution
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags process creation where AgentExecutor.exe is executed with command-line arguments indicating embedded PowerShell execution (e.g., -powershell or -remediationScript) and where PowerShell is invoked via the provided path argument. Attackers may abuse AgentExecutor.exe as an LOLBIN to run PowerShell with a lowered or bypassed execution policy, enabling stealthy script execution. The detection relies on Windows process creation telemetry, matching the AgentExecutor.exe image and specific command-line substrings, with an exclusion for Intune Windows agent parent processes.

Reporting behind it

Related detections9 linkedT1218 — drag to rearrange

Suspicious Cabinet Extraction of Masqueraded vstm Archive via extrac32

Malicious DLL Execution via Wuauclt Update Handler (via process_creation)

Malicious aspnet_compiler.exe Injection Host Spawned by PowerShell via process_creation

Malicious regsvcs LOLBin Loading Ransomware DLL from UNC Path

Suspicious RegAsm or RegSvcs Spawned by Script Host (via process_creation)

Suspicious Extexport DLL Side-Loading Execution

Malicious ClickFix Execution Chain Spawning MSHTA via Pcalua on EtherRAT Infection

Suspicious TALONITE Certutil LOLBIN Decode and Download Abuse (via process_creation)

Suspicious Renamed git Binary gcmd.exe Execution (via process_creation)

Windows AgentExecutor.exe PowerShell Execution (ExecutionPolicy Bypass) Process Creation

Pivot detection · T1218 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-execution-of-agentexecutor-exe-with-powershell-bypass-7efd2c8d

title: Windows AgentExecutor.exe PowerShell Execution (ExecutionPolicy Bypass) Process Creation
id: 3aef1b3c-e462-41ae-8739-986c40ed38cc
related:
  - id: c0b40568-b1e9-4b03-8d6c-b096da6da9ab
    type: similar
  - id: 7efd2c8d-8b18-45b7-947d-adfe9ed04f61
    type: derived
status: test
description: This rule flags process creation where AgentExecutor.exe is executed with command-line arguments indicating embedded PowerShell execution (e.g., -powershell or -remediationScript) and where PowerShell is invoked via the provided path argument. Attackers may abuse AgentExecutor.exe as an LOLBIN to run PowerShell with a lowered or bypassed execution policy, enabling stealthy script execution. The detection relies on Windows process creation telemetry, matching the AgentExecutor.exe image and specific command-line substrings, with an exclusion for Intune Windows agent parent processes.
author: Nasreddine Bencherchali (Nextron Systems), memory-shards, Huntrule Team
references:
  - https://twitter.com/lefterispan/status/1286259016436514816
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Agentexecutor/
  - https://learn.microsoft.com/en-us/mem/intune/apps/intune-management-extension
  - https://twitter.com/jseerden/status/1247985304667066373/photo/1
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_agentexecutor_potential_abuse.yml
date: 2022-12-24
modified: 2024-08-07
tags:
  - attack.stealth
  - attack.t1218
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image: \AgentExecutor.exe
    - OriginalFileName: AgentExecutor.exe
  selection_cli:
    CommandLine|contains:
      - " -powershell"
      - " -remediationScript"
  filter_main_intune:
    ParentImage|endswith: \Microsoft.Management.Services.IntuneWindowsAgent.exe
  condition: all of selection_* and not 1 of filter_main_*
falsepositives:
  - Legitimate use via Intune management. You exclude script paths and names to reduce FP rate
level: medium
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL