Windows: Detect Runscripthelper.exe executing PowerShell scripts with 'surfacecheck'
Detects Runscripthelper.exe executions with "surfacecheck" in the command line on Windows.
FreeReviewedSigma · Medium · v2
- Product
- windows
- Category
- process_creation
- Author
- Victor Sergeev, oscd.community (SigmaHQ), DRL 1.1
- Published
- 2020-10-09
- Updated
- 2026-07-31
ATT&CK techniques
Execution → Defense EvasionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process creation where the executable path ends with Runscripthelper.exe and the command line contains the string 'surfacecheck'. Attackers can use LOLBin-style execution helpers to run script content while blending into normal Windows activity. The detection relies on Windows process creation telemetry including the image path and the full command line.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-process-execution-of-runscripthelper-exe-spawning-powershell-script-acti-eca49c87
title: "Windows: Detect Runscripthelper.exe executing PowerShell scripts with 'surfacecheck'"
id: e0e90072-d2e4-4b8f-989f-595c5d2a5e30
status: test
description: This rule flags process creation where the executable path ends with Runscripthelper.exe and the command line contains the string 'surfacecheck'. Attackers can use LOLBin-style execution helpers to run script content while blending into normal Windows activity. The detection relies on Windows process creation telemetry including the image path and the full command line.
references:
- https://lolbas-project.github.io/lolbas/Binaries/Runscripthelper/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_lolbin_runscripthelper.yml
author: Victor Sergeev, oscd.community, Huntrule Team
date: 2020-10-09
modified: 2022-07-11
tags:
- attack.execution
- attack.stealth
- attack.t1059
- attack.t1202
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \Runscripthelper.exe
CommandLine|contains: surfacecheck
condition: selection
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: eca49c87-8a75-4f13-9c73-a5a29e845f03
type: derived