Windows: Detect Runscripthelper.exe executing PowerShell scripts with 'surfacecheck'

ATT&CK techniques

Execution → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
- T1059Command and Scripting Interpreter
Persistence
Priv Esc
Defense Evasion
- T1202Indirect Command Execution
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags process creation where the executable path ends with Runscripthelper.exe and the command line contains the string 'surfacecheck'. Attackers can use LOLBin-style execution helpers to run script content while blending into normal Windows activity. The detection relies on Windows process creation telemetry including the image path and the full command line.

Reporting behind it

Related detections9 linkedT1059 — drag to rearrange

Windows Execution of Renamed NirCmd.exe (nircmd.exe/nircmdc.exe) via PE OriginalFileName

Windows: Detect renamed PingCastle binary execution via PE metadata and scanner command-line

Windows Process Creation: Execution of Renamed curl.exe via PE Metadata

Windows: Detect ftp.exe Executed With -s or /s for Script-Based Command Execution

Windows Renamed ftp.exe Execution via OriginalFileName PE Metadata

Windows Process Creation: Outlook EnableUnsafeClientMailRules Security Setting Enabled

AutoIt Script Execution via A3X Payload

Suspicious Python Execution via Renamed Synaptics Binary

MSBuild Executing Non-Project File or Remote Payload

Windows: Detect Runscripthelper.exe executing PowerShell scripts with 'surfacecheck'

Pivot detection · T1059 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-execution-of-runscripthelper-exe-spawning-powershell-script-acti-eca49c87

title: "Windows: Detect Runscripthelper.exe executing PowerShell scripts with 'surfacecheck'"
id: e0e90072-d2e4-4b8f-989f-595c5d2a5e30
status: test
description: This rule flags process creation where the executable path ends with Runscripthelper.exe and the command line contains the string 'surfacecheck'. Attackers can use LOLBin-style execution helpers to run script content while blending into normal Windows activity. The detection relies on Windows process creation telemetry including the image path and the full command line.
references:
  - https://lolbas-project.github.io/lolbas/Binaries/Runscripthelper/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_lolbin_runscripthelper.yml
author: Victor Sergeev, oscd.community, Huntrule Team
date: 2020-10-09
modified: 2022-07-11
tags:
  - attack.execution
  - attack.stealth
  - attack.t1059
  - attack.t1202
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \Runscripthelper.exe
    CommandLine|contains: surfacecheck
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: eca49c87-8a75-4f13-9c73-a5a29e845f03
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL