Windows Process Execution of Runscripthelper.exe Spawning PowerShell Script Activity

title: Windows Process Execution of Runscripthelper.exe Spawning PowerShell Script Activity
id: e0e90072-d2e4-4b8f-989f-595c5d2a5e30
status: test
description: This rule flags process creation events where the executable path ends with \Runscripthelper.exe and the command line contains the string "surfacecheck". Such activity can indicate an attacker using Runscripthelper.exe to initiate PowerShell-based script execution in a stealthy way. The detection relies on Windows process creation telemetry, specifically the process image path and command-line contents.
references:
  - https://lolbas-project.github.io/lolbas/Binaries/Runscripthelper/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_lolbin_runscripthelper.yml
author: Victor Sergeev, oscd.community, Huntrule Team
date: 2020-10-09
modified: 2022-07-11
tags:
  - attack.execution
  - attack.stealth
  - attack.t1059
  - attack.t1202
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \Runscripthelper.exe
    CommandLine|contains: surfacecheck
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: eca49c87-8a75-4f13-9c73-a5a29e845f03
    type: derived