Sigma rule: Alternate PowerShell Hosts - PowerShell Module

Rule

Title

Alternate PowerShell Hosts - PowerShell Module

Status

test

Level

medium

Author

Roberto Rodriguez @Cyb3rWard0g

Date

2019-08-11

Modified

2026-10-19

File

rules/windows/powershell/powershell_module/posh_pm_alternate_powershell_hosts.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe

Log source

product

windows

category

ps_module

definition

0ad03ef1-f21b-4a79-8ce8-e6900c54b65b

Detection

selection:
    ContextInfo|contains: '*'
filter_powershell:
    # This filter covers the following use cases
    #   - When powershell is called directly from commandline via keyword powershell or powershell.exe
    #   - Or called via path but not with full "".exe". Example: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell
    ContextInfo|contains:
        - '= powershell' # Host Application=...powershell.exe or Application hote=...powershell.exe in French Win10 event
        - '= C:\Windows\System32\WindowsPowerShell\v1.0\powershell'
        - '= C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell'
        # In some cases powershell was invoked with inverted slashes
        - '= C:/Windows/System32/WindowsPowerShell/v1.0/powershell'
        - '= C:/Windows/SysWOW64/WindowsPowerShell/v1.0/powershell'
        # In some cases \??\C:.. is used
        - '= \\\?\?\C:Windows\System32\WindowsPowerShell\v1.0\powershell'
        - '= \\\?\?\C:Windows\SysWOW64\WindowsPowerShell\v1.0\powershell'
filter_sdiagnhost:
    ContextInfo|contains: '= C:\WINDOWS\System32\sdiagnhost.exe -Embedding' # When MSDT is launched for example
filter_citrix:
    ContextInfo|contains: 'ConfigSyncRun.exe'
filter_adace:  # Active Directory Administrative Center Enhancements
    ContextInfo|contains: 'C:\Windows\system32\dsac.exe'
filter_winrm:
    ContextInfo|contains: 'C:\Windows\system32\wsmprovhost.exe -Embedding'
filter_help_update:
    Payload|contains:
        - 'Update-Help'
        - 'Failed to update Help for the module'
filter_wapshost:
    ContextInfo|contains: 'Host Name = WaPSHost'
condition: selection and not 1 of filter_*

False positives (as the rule lists them)

• Programs using PowerShell directly without invocation of a dedicated interpreter
• MSP Detection Searcher
• Citrix ConfigSync.ps1

Tags

• attack.execution
• attack.t1059.001

MITRE ATT&CK ids this rule names

• T1059.001

References

• https://threathunterplaybook.com/hunts/windows/190610-PwshAlternateHosts/notebook.html

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/powershell/powershell_module/posh_pm_alternate_powershell_hosts.yml