Sigma rule: Non Interactive PowerShell Process Spawned

Rule

Title

Non Interactive PowerShell Process Spawned

Status

test

Level

low

Author

Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements)

Date

2019-09-12

Modified

2025-02-28

File

rules/windows/process_creation/proc_creation_win_powershell_non_interactive_execution.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects non-interactive PowerShell activity by looking at the "powershell" process with a non-user GUI process such as "explorer.exe" as a parent.

Log source

product

windows

category

process_creation

Detection

selection:
    - Image|endswith:
          - '\powershell.exe'
          - '\pwsh.exe'
    - OriginalFileName:
          - 'PowerShell.EXE'
          - 'pwsh.dll'
filter_main_generic:
    ParentImage|endswith:
        - ':\Windows\explorer.exe'
        - ':\Windows\System32\CompatTelRunner.exe'
        - ':\Windows\SysWOW64\explorer.exe'
filter_main_windows_update:
    ParentImage: ':\$WINDOWS.~BT\Sources\SetupHost.exe' # During Windows updates/upgrades
    # CommandLine: powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';
filter_optional_vscode:
    # Triggered by VsCode when you open a Shell inside the workspace
    ParentImage|endswith: '\AppData\Local\Programs\Microsoft VS Code\Code.exe'
    ParentCommandLine|contains: ' --ms-enable-electron-run-as-node '
filter_optional_terminal:
    ParentImage|contains: ':\Program Files\WindowsApps\Microsoft.WindowsTerminal_'
    ParentImage|endswith: '\WindowsTerminal.exe'
filter_optional_defender:
    ParentImage|endswith: ':\Program Files\Windows Defender Advanced Threat Protection\SenseIR.exe'
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*

False positives (as the rule lists them)

• Likely. Many admin scripts and tools leverage PowerShell in their BAT or VB scripts which may trigger this rule often. It is best to add additional filters or use this to hunt for anomalies

Tags

• attack.execution
• attack.t1059.001

MITRE ATT&CK ids this rule names

• T1059.001

References

• https://web.archive.org/web/20200925032237/https://threathunterplaybook.com/notebooks/windows/02_execution/WIN-190410151110.html

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_powershell_non_interactive_execution.yml